EpiSource

Organization

EpiSource

Source

California AG · source record

Date reported

Jun 2, 2023

Date(s) of breach

Sunday, February 19, 2023Tuesday, February 21, 2023

Residents affected

Not published by this source

Data exposed

Social Security number Financial / bank account Medical / health information Date of birth Phone number Postal address Name

Notice letter

Sample notice (PDF)

Discovered

Apr 20, 2023, as stated in the letter

"On April 20, 2023, after detailed forensics work, EpiSource determined that the data contained within EpiSource’s AWS environment may have involved some of your health and/or personal information."

Days to notice

43 days from discovery (Apr 20, 2023) to the California record (Jun 2, 2023). Statute: 30 days from discovery or notification of the breach (Cal. Civ. Code § 1798.82). Over the statutory period

Offered in the letter

12 months of credit or identity monitoring through Experian

Third party

The letter attributes the incident to a vendor or service provider

First seen by BreachTally

2026-10-30 15:58 UTC

Dates and counts as filed by the organization with the agency. The breach window and the report date often differ by months.