HackingEducationProfessional ServicesEducationData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

92nd Street Y

bd_0bff414faf69fc45 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 23, 2021

Filed

Jan 18, 2022

To disclose

21 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

63%

Full breach record for 92nd Street Y →2 incidents on file

The Young Men's and Young Women's Hebrew Association (92Y) reported unauthorized access to its network in August 2021. The organization identified unusual activity on August 23, 2021, and determined that certain files may have been downloaded. A review of affected files was completed in January 2022. Affected data included names and other personal information. 92Y implemented additional security measures and offered credit monitoring to impacted individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 23, 2021 → Notified Jan 18, 2022148d ✗ CA 60-day late21 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 21 weeks / 148 days

Aug 22, 2021

Begins

Aug 23, 2021

Discovered

Jan 18, 2022

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_18150632b9c2ac1b2022-01-18Verified
Maine State AGbd_ee7489f07211a0de2022-01-18Verified

Name: 92nd Street Y
norm: 92nd street y

Name: 92nd Street Y
norm: 92nd street y
Also named: The Young Men's and Young Women's Hebrew Associationdba oflegal entity
92nd Street Ydba oftrade name
Industry: EducationllmProfessional Servicesllm

Discovered: Aug 23, 2021
Breach occurred: Aug 22, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 18, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts

During the incident: Commenced an investigation into the activity to determine its nature and scope
Undertook a comprehensive and diligent review of the potentially affected files
Implemented additional technical security measures
Offering complimentary access to credit monitoring through IDX
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: CA 60-day late · 148d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 23, 2021
→ Notified: Jan 18, 2022
148d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 23, 2021 → Notified: Jan 18, 2022	148d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJan 18 · first

Maine State AGJan 18 · first

California State AGJan 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-550077
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 18, 2022
Raw hash: 83cce8b02d0db4baaa2b197f53596530fd8b1cb5e9d52b2b7b65ddaa861d22d3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entity92nd Street Y

Victim entity92nd Street Y

Incidentdiscovered Aug 23, 2021

Stated responseCommenced an investigation into the activity to determine its nature and scope

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov