Clustered 2 filings across 2 jurisdictions · filed May 18, 2021. View entity profile → Other incidents for this victim →
incident inc_0c7259d0bb0b4eed · merge_method deterministic · confidence 100%
Discovered → first regulatory filing
Range of discovered_at dates across filings
Identity (basic) · Government ID
Time between earliest and latest filing
Not recorded for this incident
Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster.
CA ME
all State AG
Earliest sighting first · deep chronology in Litigation Timeline
Sep 26, 2020 → Oct 12, 2020
When the intrusion reportedly occurred, per the linked filings
Oct 12, 2020
Reported by CALIFORNIA AG filing
Oct 23, 2020
Reported by MAINE AG filing
Health Plan of San Joaquin (HPSJ) experienced a hacking incident from September 26 to October 12, 2020, discovered on October 23, 2020. The breach affected 420,433 individuals, compromising names and Social Security numbers. HPSJ notified consumers on May 18, 2021, and offered 12 months of identity theft protection services through Equifax.
Affected (this filing): 420,433
Health Plan of San Joaquin (HPSJ) notified California residents of a data breach involving unauthorized access to employee email accounts. The incident occurred between September 26, 2020, and October 12, 2020, following a phishing attack. Affected data included names, SSNs, DOBs, and health information. HPSJ reset passwords, engaged forensic specialists, and offered 12 months of free identity monitoring via Equifax.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.