Social EngineeringStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Woodruff Sawyer & Co.
bd_0a098efd7c6a3bea · schema v1 · pii pii-v1
Full breach record for Woodruff Sawyer & Co. →Woodruff-Sawyer & Co. experienced a data breach on January 20, 2024, when an unauthorized third party gained access to computer systems via SIM swapping of an executive's phone number. The attacker reset the executive's password and downloaded a small subset of files containing personal information. The company engaged cybersecurity experts, notified the FBI, and amended security controls. Affected individuals are offered 24 months of Experian IdentityWorks.
California clockDiscovered Jan 20, 2024 → Notified May 8, 2024109d ✗ CA 60-day late23 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-587730
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 28, 2024
- Raw hash
- 7ea6a20d8277a178f494e24ea8afb38401fe26665aa3deec45d1d0f040c60e56
Reporting entity
- Name
- Woodruff Sawyer & Co.norm: woodruff sawyer
- Domain
- woodruffsawyer.com
Victim entity
- Name
- Woodruff Sawyer & Co.norm: woodruff sawyer
- Domain
- woodruffsawyer.com
Incident
- Discovered
- Jan 20, 2024
- Materiality determined
- —
- Notification sent
- May 8, 2024
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified the Federal Bureau of Investigation (FBI)
- Initial access
- phishing_link
Compliance
- Time to disclose
- 23 weeks(160 days from discovery to filing)
- Compliance flags
- CA 60-day late · 109d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 20, 2024→ Notified: May 8, 2024109d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.