HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

AFNI, INC.

bd_12a087524a070136 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 7, 2021

Filed

Jul 11, 2022

To disclose

13 months

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for AFNI, INC. →2 incidents on file

Afni, Inc. discovered anomalous network activity on June 7, 2021, indicating unauthorized access to certain systems. An investigation determined that an unauthorized actor may have viewed or taken data, including names, addresses, social security numbers, and dates of birth. The review of impacted data was finalized on June 3, 2022. Afni is offering 12 months of complimentary credit monitoring and identity theft protection through Equifax.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 7, 2021 → Notified Jun 14, 2022372d ✗ CA 60-day late13 months discovery → filing

Incident timeline

discovery → filing · 13 months / 399 days

Jun 7, 2021

Begins

Jun 7, 2021

Discovered

Jul 11, 2022

Filed

vs. sector median

+38 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_443af9e6561441872022-07-11Verified
Indiana State AGbd_5630afede7aa4f572022-07-11Verified
Washington State AGbd_658798f82dbd21772022-07-11Verified
Delaware State AGbd_b50bc1d6295aa9ed2022-07-11Verified

Show 4 more filings ↓up to 191d gap

Oregon State AGbd_b7b0e4beb608b17f2022-07-11Verified
Maine State AGbd_dd102326b4704f302022-07-11Verified
South Carolina State AGbd_1c373e5670b8ed452022-07-12 · +1dVerified
Illinois State AGbd_433840d69667e09a2022-01-01 · +191dCandidate

Name: AFNI, INC.
norm: afni

Name: AFNI, INC.
norm: afni
Industry: Professional Servicesllm

Discovered: Jun 7, 2021
Breach occurred: Jun 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Conducted a thorough and in-depth review of the information within those systems to identify individuals with personal information that was potentially accessible
Offering credit monitoring and identity theft protection services through Equifax for 12 months, at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(399 days from discovery to filing)
Compliance flags: CA 60-day late · 372d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 7, 2021
→ Notified: Jun 14, 2022
372d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 7, 2021 → Notified: Jun 14, 2022	372d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+191d

Indiana State AG+191d

Washington State AG+191d

Delaware State AG+191d

Oregon State AG+191d

Maine State AG+191d

California State AG+191d · this page

South Carolina State AG+192d

Pattern: first filing Jan 1 (IL), last Jul 12 (SC) — a 192-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-555145
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2022
Raw hash: e6fd3905a9cb5f031c95c530e1b21b2b724491d6e4bd15e9bbeaa2facf1fc2dd

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityAFNI, INC.

Victim entityAFNI, INC.

Incidentdiscovered Jun 7, 2021

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov