HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTPHIHEALTH_BASICMediumContained
CBIZ Benefits & Insurance Services, Inc.
bd_057a72d6ef710190 · schema v1 · pii pii-v1
Full breach record for CBIZ Benefits & Insurance Services, Inc. →Diversified Benefit Services Insurance Marketing, Inc. reported that an unauthorized actor gained access to its email system on August 7, 2025, potentially downloading emails and files containing names, Social Security Numbers, and health insurance information. The company secured the environment, engaged forensic experts, and is offering credit monitoring and fraud assistance to affected individuals.
California clockDiscovered Aug 7, 2025 → Notified Jan 20, 2026166d ✗ CA 60-day late24 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-617391
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 21, 2026
- Raw hash
- acc465552353e29d708388d7fdeb6a90e49ce9d9bbea29423cabb076b9c38d20
Reporting entity
- Name
- CBIZ Benefits & Insurance Services, Inc.norm: cbiz benefits insurance
Victim entity
- Name
- CBIZ Benefits & Insurance Services, Inc.norm: cbiz benefits insurance
Incident
- Discovered
- Aug 7, 2025
- Materiality determined
- —
- Notification sent
- Jan 20, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPHIHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 24 weeks(167 days from discovery to filing)
- Compliance flags
- CA 60-day late · 166dCA AG copy ≤15d · 1d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 7, 2025→ Notified: Jan 20, 2026166d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Jan 20, 2026→ AG copy submitted: Jan 21, 20261d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.