DisclosureLens
HackingTransportation & LogisticsTransportationStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)PIILowContained

San Mateo County Transit District

bd_0aea78bc92c5dedb · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 2, 2021

Filed

May 23, 2022

To disclose

51 weeks

Affected

Not disclosed

Confidence

65%
Full breach record for San Mateo County Transit District →

San Mateo County Transit District (SMCTD) notified individuals of a data security incident on May 23, 2022. On June 2, 2021, SMCTD detected unusual activity in its email environment and launched an investigation. The investigation determined that unauthorized access occurred to certain employee email accounts. A comprehensive analysis concluded on March 2, 2022, that some individuals' personal information (names and other variable data) resided in the accessed accounts. SMCTD stated there is no evidence the information itself was accessed without authorization or misused. The organization secured its email environment, implemented enhanced security measures, notified the FBI, and offered one year of complimentary identity monitoring and protection services through IDX.

California clockDiscovered Jun 2, 2021 → Notified May 23, 2022355d ✗ CA 60-day late51 weeks discovery → filing

Incident timeline

discovery → filing · 51 weeks / 355 days

Jun 2, 2021

Begins

Jun 2, 2021

Discovered

May 23, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.