Social EngineeringEnergy & UtilitiesUtilitiesPhishingEmployee Data InvolvedTargetedGovernment IDIdentity (basic)Financial accountEmploymentMediumResolved

SUNRUN INC.

bd_0f1387b75910b066 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2017

Filed

Feb 2, 2017

To disclose

13 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for SUNRUN INC. →

On January 20, 2017, Sunrun Inc. experienced a targeted phishing scam where a scammer impersonated the CEO to request employee W-2s from the payroll department. The phishing email was not recognized as a scam, resulting in the external disclosure of 2016 W-2s for current and former employees. Affected data included names, addresses, Social Security numbers, salaries, and taxes withheld. Sunrun notified the FBI, IRS, and state taxing authorities and offered two years of free credit monitoring via Experian's ProtectMyID Alert. The company is reinforcing its information security training to prevent future incidents.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 20, 2017 → Notified Jan 30, 201710d ✓ CA 60-day OK13 days discovery → filing

Incident timeline

discovery → filing · 13 days

Jan 20, 2017

Begins

Jan 20, 2017

Discovered

Feb 2, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_157831bf640fc7ca2017-02-02Verified
New Hampshire State AGbd_aa9215fecf4ff63d2017-02-02Verified

Name: SUNRUN INC.
norm: sunrun

Name: SUNRUN INC.
norm: sunrun
Industry: Energy & Utilitiesllm

Discovered: Jan 20, 2017
Breach occurred: Jan 20, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2017
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI, IRS and state taxing authorities
Initial access: phishing_link

During the incident: Notified the FBI, IRS and state taxing authorities
Offering every affected individual a two-year free membership to Experian’s ProtectMyID Alert
Changes made: Reinforcing our information security training program with an emphasis on the detection and avoidance of phishing email scams
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: CA 60-day OK · 10d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 20, 2017
→ Notified: Jan 30, 2017
10d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 20, 2017 → Notified: Jan 30, 2017	10d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 2 · first

New Hampshire State AGFeb 2 · first

California State AGFeb 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66148
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2017
Raw hash: 97221d9e9114d94a7241a338614bf109eb6fe14763fa9e9183a1348519031b06

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySUNRUN INC.

Victim entitySUNRUN INC.

Incidentdiscovered Jan 20, 2017

Stated responseNotified the FBI, IRS and state taxing authorities

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov