Injectable Therapy Services, Inc. notified the California AG of a data breach where unauthorized access occurred on Dec 8, 2023, and was discovered on Dec 13, 2023. The attacker used valid credentials to exfiltrate data including names and payment information. The company blocked access, engaged experts, and notified law enforcement. Substitute notice was posted Feb 9, 2024. Rhode Island residents were specifically mentioned as impacted.