MalwareTelecom & MediaInformationRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

SFJAZZ (San Francisco Jazz Organization)

bd_01209b0af71b8087 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2023

Filed

Nov 2, 2023

To disclose

23 weeks

Affected

Not disclosed

Linked

5 records

Confidence

64%

Full breach record for SFJAZZ (San Francisco Jazz Organization) →

San Francisco Jazz Organization experienced a ransomware attack on May 23, 2023, encrypting critical systems. Forensic investigation revealed potential access to employee personal information, including names, SSNs, and driver's license numbers. The organization engaged third-party experts, contained the incident, and implemented enhanced security measures including MFA and encryption. Affected individuals were offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 23, 2023 → Notified Oct 25, 2023155d ✗ CA 60-day late23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 163 days

May 23, 2023

Begins

May 23, 2023

Discovered

Nov 2, 2023

Filed

This filing is one of 5 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 77 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_9b777f78aba0f4082023-08-17 · +77dVerified by operator

Regulatory filings (3) · sorted by filing gap

California State AGbd_2b635014f36212de2023-09-18 · +45dVerified by operator
Montana State AGbd_1cd2694cf115ef3a2023-09-15 · +48dVerified by operator
Massachusetts State AGbd_51ffdec06574f95e2023-07-31 · +94dVerified by operator

Name: SFJAZZ (San Francisco Jazz Organization)
norm: sfjazz san francisco jazz organization
Domain: sfjazz.org

Name: SFJAZZ (San Francisco Jazz Organization)
norm: sfjazz san francisco jazz organization
Domain: sfjazz.org
Industry: Telecom & Medianaics map

Discovered: May 23, 2023
Breach occurred: May 23, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 25, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Launched our incident response protocols to contain and mitigate the situation
Engaged third-party cybersecurity experts on June 1 to conduct a comprehensive forensic investigation
Changes made: Hardening our systems by installing industry leading countermeasures, such as enhanced encryption, for all sensitive devices
Fully updating security controls on users and their data
Implementing two-factor authentication across all of our systems and users
Offering complimentary access to Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(163 days from discovery to filing)
Compliance flags: CA 60-day late · 155dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 23, 2023
→ Notified: Oct 25, 2023
155d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 23, 2023 → Notified: Oct 25, 2023	155d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 31 · first

Montana State AG+46d

California State AG+49d

California State AG+94d · this page

Pattern: first filing Jul 31 (MA), last Nov 2 (CA) — a 94-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-576019
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 2, 2023
Raw hash: 3c6888d4556b8857b886d0fa5aded38fff58edc9626cea6ea2bd6175601f5097

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entitySFJAZZ (San Francisco Jazz Organization)

Victim entitySFJAZZ (San Francisco Jazz Organization)

Incidentdiscovered May 23, 2023

Stated responseLaunched our incident response protocols to contain and mitigate the situation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov