Disclosures Claims Reports Entities Incidents Pulse

Feed live

DisclosureLens

Structured extracts of public breach disclosures — regulator filings (SEC, HHS, state AGs, EU DPAs) alongside threat-actor leak-site claims and press reports. SEC and HHS filings render inline from the originating regulator’s public record under the fair report privilege; other sources link out to the source URL. AI-extracted with full per-record audit trail (model, prompt version, confidence).

ai_assisted: true · Article 50 disclosure on every record

Product

Disclosures feed
Pulse · analytics
Entities
Breach notifications by state

Methodology

How extraction works
Confidence & review
About the bot

Trust

Security
Self-disclosure commitment
API documentation
API keys

v0.1.0 · coverage growing weekly

Institute on Aging data breach (2018) · DisclosureLens

All incidents View linkage analytics →

Merged incident · 2 filings

Institute on Aging

Clustered 2 filings across 1 jurisdiction · filed Jul 20, 2018. View entity profile → Other incidents for this victim →

⚠ 1 cross-filing discrepancy →Merge100%

Confirmed breach. Intrusion May 28, 2018, discovered May 28, 2018 — the first regulatory filing landed 53 days later. 3,907 individuals reported across the linked filings.

incident inc_e8108ad06b9243bb · merge_method deterministic · confidence 100%

Litigation Timing

Notification delay

53days

Discovered → first regulatory filing

Filing span

0days

Time between earliest and latest filing

Not recorded for this incident

Discovery variance · Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster; needs two dated filings.

Regulatory clocksHIPAA✓ HHS notifiedCalifornia✓ CA 60-day OK · 53dFull clock table in Litigation Timeline

HHS OCRState AGConfirmedLifecycle stage 2 of 3: ConfirmedUnverified claimConfirmedEnforcedmoderate sensitivity

Affected (total reported)

3,907

Data types

PHI · Health (basic) · Identity (basic)

Jurisdictions

Linked filings

HHS OCR · State AG

Timeline

Earliest sighting first · deep chronology in Litigation Timeline

Breach window
May 28, 2018
When the intrusion reportedly occurred, per the linked filings
Breach discoveredletter-grounded
May 28, 2018
Reported by CALIFORNIA AG filing
53 days
CALIFORNIAHHS OCRFirst filing
Filed Jul 20, 2018bd_00d388c7d4e11940
Institute on Aging reported to HHS on 2018-07-20 a Hacking/IT Incident affecting 3907 individuals. Breached information located on Email. Phishing attacks compromised workforce email accounts containing patient PHI (demographic, clinical, payment). CE hired forensic investigators, deployed advanced threat protection, retrained staff, and provided identity protection services.
Affected (this filing): 3,907
HHS notified
🐻California State AGMost recentlinked via same-victim cross-source · 100%
Filed Jul 20, 2018bd_0d69c6dea7015a77
Institute on Aging reported unauthorized access to employee email accounts on May 28, 2018. Approximately 3,907 California residents may have been affected. Compromised data included names, addresses, SSNs, and health information. The organization secured systems, notified the FBI, and offered 12 months of credit monitoring.
Affected (this filing): 3,907

About this clustering

DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.

CA 60-day OK · 53d