PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Allergy & Asthma Medical Group of the Bay Area, Inc.

bd_fd79673a9f22b64f · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 28, 2020

Filed

Jun 2, 2020

To disclose

5 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

63%

Full breach record for Allergy & Asthma Medical Group of the Bay Area, Inc. →

Allergy & Asthma Medical Group of the Bay Area, Inc. reported a physical break-in at its Berkeley office on April 27, 2020, resulting in the theft of three laptops. The incident was discovered on April 28, 2020. The stolen devices potentially contained patient names, dates of birth, group ID numbers, physician names, and FeNo test results (health data). Financial information, SSNs, and medical records were not accessible. The organization changed passwords, reported to law enforcement, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 28, 2020 → Notified May 5, 20207d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 5 weeks / 35 days

Apr 27, 2020

Begins

Apr 28, 2020

Discovered

Jun 2, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_2bdfda39eac70aab2020-06-02Candidate

Name: Allergy & Asthma Medical Group of the Bay Area, Inc.
norm: allergy asthma medical group of the bay area
Domain: bayareaallergy.com

Name: Allergy & Asthma Medical Group of the Bay Area, Inc.
norm: allergy asthma medical group of the bay area
Domain: bayareaallergy.com
Industry: Healthcarellm

Discovered: Apr 28, 2020
Breach occurred: Apr 27, 2020 – Apr 27, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 5, 2020
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Reporting this incident to law enforcement and appropriate state and federal regulators

During the incident: Initiated an investigation
Changed all laptop and mainframe passwords
Reporting this incident to law enforcement and appropriate state and federal regulators
Securing the services of a company to provide identity monitoring at no cost for twelve (12) months
Changes made: Reviewing security measures to identify and implement any potential enhancements to security and privacy policies
Conducting additional employee training on technical, administrative, and physical security and privacy safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: CA 60-day OK · 7d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 28, 2020
→ Notified: May 5, 2020
7d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 28, 2020 → Notified: May 5, 2020	7d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 2 · first

California State AGJun 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190553
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2020
Raw hash: b81581abfe68bb3291e95f8e3314ea7b17e0d931562f084d07179a2bdbfaca04

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAllergy & Asthma Medical Group of the Bay Area, Inc.

Victim entityAllergy & Asthma Medical Group of the Bay Area, Inc.

Incidentdiscovered Apr 28, 2020

Stated responseInitiated an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov