San Mateo County Transit District
bd_0aea78bc92c5dedb · schema v1 · pii pii-v1
Full breach record for San Mateo County Transit District →San Mateo County Transit District (SMCTD) notified individuals of a data security incident on May 23, 2022. On June 2, 2021, SMCTD detected unusual activity in its email environment and launched an investigation. The investigation determined that unauthorized access occurred to certain employee email accounts. A comprehensive analysis concluded on March 2, 2022, that some individuals' personal information (names and other variable data) resided in the accessed accounts. SMCTD stated there is no evidence the information itself was accessed without authorization or misused. The organization secured its email environment, implemented enhanced security measures, notified the FBI, and offered one year of complimentary identity monitoring and protection services through IDX.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-553645
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 23, 2022
- Raw hash
- a9aa3d74717908802b67bced12b0b9380bde2857e44d7e839dcf1db510787e38
Reporting entity
- Name
- San Mateo County Transit Districtnorm: san mateo county transit district
Victim entity
- Name
- San Mateo County Transit Districtnorm: san mateo county transit district
Incident
- Discovered
- Jun 2, 2021
- Materiality determined
- —
- Notification sent
- May 23, 2022
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Notified the Federal Bureau of Investigation
Compliance
- Time to disclose
- 51 weeks(355 days from discovery to filing)
- Compliance flags
- CA 60-day late · 355d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 2, 2021→ Notified: May 23, 2022355d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.