Clustered 3 filings across 2 jurisdictions · filing window Sep 15, 2023 → Sep 22, 2023. View entity profile → Other incidents for this victim →
incident inc_b838f7fbacfc4161 · merge_method deterministic · confidence 100%
Discovered → first regulatory filing
Range of discovered_at dates across filings
Identity (basic) · Government ID
Time between earliest and latest filing
Not recorded for this incident
Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster.
DE VT
all State AG
Earliest sighting first · deep chronology in Litigation Timeline
Aug 2, 2023
Reported by VERMONT AG, DELAWARE AG filings
IBM notified Johnson & Johnson Health Care Systems, Inc. (Janssen) of unauthorized access to the Janssen CarePath database. Access was discovered on August 2, 2023. The scope of access is undetermined. Data potentially exposed includes names and other PII; SSNs and financial data were not in the database. IBM remediated the vulnerability and offered one year of credit monitoring.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.
Johnson & Johnson Health Care Systems, Inc. (Janssen) experienced unauthorized access to a database supporting the Janssen CarePath patient support platform. The database was managed by third-party provider IBM. The incident involved a technical method allowing unauthorized access, identified on August 2, 2023. Affected data included names and potentially other personal information, though SSNs and financial account numbers were explicitly excluded. IBM and Janssen remediated the vulnerability and augmented security controls. Affected individuals were offered one year of credit monitoring. The notice covers residents of multiple states, including Delaware, New York, and Maryland.
Johnson & Johnson Health Care Systems, Inc. (Janssen) notified IBM, its service provider, of unauthorized access to the Janssen CarePath database. IBM and a third-party database provider remediated the technical vulnerability and conducted an investigation. The incident, discovered on August 2, 2023, potentially exposed names and government identifiers (e.g., SSN) for approximately 10,000 Rhode Island residents. No financial account or SSN data was in the database. Affected individuals were offered one year of credit monitoring.
Affected (this filing): 10,000