CareMeridian, LLC data breach (2018)

Breach discovered

Dec 21, 2017

Reported by CALIFORNIA AG filing

Breach window

Dec 23, 2017

When the intrusion reportedly occurred, per the linked filings

87 days

🐻California State AGFirst filinglinked via same-victim cross-source · 100%

Filed Mar 20, 2018bd_0944bf9bbe2ce4b9

CareMeridian, LLC reported a data event in California involving the loss of an unencrypted disk sent by a third-party software provider. The disk contained protected personal information, including names and medical information for 953 California residents, and names and Social Security numbers for 13 residents. CareMeridian retained forensic experts, ceased business with the provider, and offered credit monitoring to affected individuals.

Affected (this filing): 953

CA 60-day late · 89d

MASSACHUSETTSHHS OCRMost recentlinked via same-victim cross-source · 100%

Filed Mar 21, 2018bd_0ed8c4a9b105ca17

CareMeridian, LLC reported to HHS on 2018-03-21 a Loss affecting 1922 individuals. Breached information located on Other Portable Electronic Device. A business associate (Bullpen Financial, Inc.) mailed an unencrypted USB drive containing ePHI (demographic and clinical info) which was lost in the mail.

Affected (this filing): 1,922

CareMeridian, LLC

Litigation Timing

Sensitive data

Timeline