HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

Systems Application & Technologies, Inc.

bd_035d95d8420b5eba · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 26, 2024

Filed

Oct 23, 2024

To disclose

30 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Systems Application & Technologies, Inc. →

Systems Application & Technologies Inc. (SA-TECH) notified the California AG of unauthorized access to certain network files between March 20 and March 26, 2024. The company became aware of suspicious activity on March 26, 2024. An investigation determined that files were accessed and/or taken without authorization. The incident involved personal information, including names and potentially other identity data. SA-TECH engaged cybersecurity specialists, conducted a data review, and is offering 12 months of credit monitoring and fraud assistance to affected individuals. The incident is contained.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 26, 2024 → Notified Oct 23, 2024211d ✗ CA 60-day late30 weeks discovery → filing

Incident timeline

undetected · 6 days

discovery → filing · 30 weeks / 211 days

Mar 20, 2024

Begins

Mar 26, 2024

Discovered

Oct 23, 2024

Filed

vs. sector median

+19 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_15a87e483ce638db2024-10-23Candidate
Massachusetts State AGbd_c8fced6e4680e2c62024-10-23Verified
Indiana State AGbd_ef5a927cdce21c5f2024-10-23Verified
Montana State AGbd_f72e6ee7b3c944a02024-10-23Verified

Name: Systems Application & Technologies, Inc.
norm: systems application
Domain: sa-techinc.com

Name: Systems Application & Technologies, Inc.
norm: systems application
Domain: sa-techinc.com
Industry: Technologyllm

Discovered: Mar 26, 2024
Breach occurred: Mar 20, 2024 – Mar 26, 2024
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified applicable regulatory authorities where necessary

During the incident: Launched an investigation into the nature and scope of the incident with the assistance of industry leading cybersecurity specialists
Conducted a comprehensive and time-intensive review of the contents of the files to determine whether sensitive information was involved
Engaged in an extensive internal reconciliation and validation effort for the information obtained
Assessed the security of our systems
Reviewed the contents of relevant data for sensitive information
Notified impacted individuals for whom we had contact information
Reviewing our policies, procedures and processes to reduce the likelihood of a similar future event
Notified applicable regulatory authorities where necessary
Changes made: Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 12 months
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: CA 60-day late · 211d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 26, 2024
→ Notified: Oct 23, 2024
211d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 26, 2024 → Notified: Oct 23, 2024	211d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGOct 23 · first

Massachusetts State AGOct 23 · first

Indiana State AGOct 23 · first

Montana State AGOct 23 · first

California State AGOct 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-593790
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2024
Raw hash: 5bd2c1ecbe0a3c0ad2262de449c9b763237025e4274e898b46bac114b071dacd

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySystems Application & Technologies, Inc.

Victim entitySystems Application & Technologies, Inc.

Incidentdiscovered Mar 26, 2024

Stated responseLaunched an investigation into the nature and scope of the incident with the assistance of industry leading cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov