Social EngineeringGovernmentGovernmentPhishingCustomer Data InvolvedTargetedHealth (basic)Identity (basic)Government IDPHIMediumContained

Employment Secruity Department of Washington State

bd_047034e59f4a77fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2023

Filed

Feb 6, 2024

To disclose

12 weeks

Affected

541state residents only

Confidence

69%

Full breach record for Employment Secruity Department of Washington State →

The Employment Security Department of Washington State (ESD) disclosed a website spoofing scam targeting Secure Access Washington (SAW) users between Oct 25 and Nov 20, 2023. ESD discovered the incident on Nov 15, 2023, and determined that 541 Washington residents' names, last four SSNs, DOBs, and medical info were accessed. Notifications began Feb 5, 2024, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d12 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 21 days

discovery → filing · 12 weeks / 83 days

Oct 25, 2023

Begins

Nov 15, 2023

Discovered

Feb 6, 2024

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed541 affectedView incident

Name: Employment Secruity Department of Washington State
norm: employment secruity department of washington state
Industry: Government

Name: Employment Secruity Department of Washington State
norm: employment secruity department of washington state
Industry: Government
Industry: Governmentllm

Discovered: Nov 15, 2023
Breach occurred: Oct 25, 2023 – Nov 20, 2023
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2024
Affected individuals: 541state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of multiple Washington State agencies and a third-party forensic specialist
Began mailing notification letters via United States Postal Service First-Class mail
Established a dedicated, toll-free call center
Offering complimentary credit monitoring and identity theft protection services
Changes made: Implementing several changes to enhance its existing security measures
Taking steps to implement additional safeguards and review policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27830.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2024
Raw hash: fcf02d2dbd664f951b51d65ebfdc3b1bf36b0baecd5172dbed3ed6a02bcc51fa

Reporting entityEmployment Secruity Department of Washington State

Victim entityEmployment Secruity Department of Washington State

Incidentdiscovered Nov 15, 2023

Stated responseLaunched an investigation with the assistance of multiple Washington State agencies and a third-party forensic specialist

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com