HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedEmployee Data InvolvedEMPLOYMENTIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Informa (including Informa Exhibitions U.S. Construction and Real Estate, Inc., other Informa U.S. entities, and Informa TechTarget)
bd_09a5942919b0f5fa · schema v1 · pii pii-v1
Full breach record for Informa (including Informa Exhibitions U.S. Construction and Real Estate, Inc., other Informa U.S. entities, and Informa TechTarget) →Informa disclosed a data breach resulting from a security incident at third-party software supplier Oracle. An unauthorized party accessed and copied records held on an Informa Oracle system between August 11 and August 18, 2025. Informa identified the unauthorized access in November 2025. Affected data includes historical employment-related information, names, and payment-related data for employees, contractors, and job applicants. Informa engaged forensic experts, notified law enforcement, and is offering 24 months of identity monitoring to affected individuals.
California clockDiscovered Nov 1, 2025 → Notified Apr 17, 2026167d ✗ CA 60-day late24 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_8e66a338c2812962Texas State AGfiled 2026-04-22(5d gap)Verified
- bd_950dd223120b88f6Maine State AGfiled 2026-05-08(21d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-621942
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 17, 2026
- Raw hash
- d3cd2ddcbea7d214488dc3060aff50baa14a8141ba37f683d6785b6f79503071
Reporting entity
- Name
- Informanorm: informa
- Domain
- informa.com
Victim entity
- Name
- Informa (including Informa Exhibitions U.S. Construction and Real Estate, Inc., other Informa U.S. entities, and Informa TechTarget)norm: informa including informa exhibitions us construction and real estate inc other informa us entities and informa techtarget
Incident
- Discovered
- Nov 1, 2025
- Materiality determined
- —
- Notification sent
- Apr 17, 2026
- Affected individuals
- Not disclosed
- Data types
- EMPLOYMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified relevant authorities, including law enforcement
- Third party
- via Oracle
- Initial access
- supply_chain
Compliance
- Time to disclose
- 24 weeks(167 days from discovery to filing)
- Compliance flags
- CA 60-day late · 167dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 1, 2025→ Notified: Apr 17, 2026167d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Apr 17, 2026→ AG copy submitted: Apr 17, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.