HackingGovernmentGovernmentStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEducationFinancial accountIdentity (basic)Government IDPHIHealth (basic)CriticalContained

Washington State Auditor's Office

bd_1d7749354ee9823d · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 12, 2021

Filed

Feb 12, 2021

To disclose

4 weeks

Affected

1,420,520state residents only

Confidence

67%

Full breach record for Washington State Auditor's Office →

Washington State Auditor's Office (SAO) reported a data breach involving third-party provider Accellion. Unauthorized access occurred in late December 2020. SAO discovered the incident on January 12, 2021. The breach exposed personal information of approximately 1,420,520 Washington residents, including names, SSNs, DOBs, and bank account details from unemployment claims. SAO engaged forensic investigators, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 42 days

discovery → filing · 4 weeks / 31 days

Dec 1, 2020

Begins

Jan 12, 2021

Discovered

Feb 12, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,420,520 affectedView incident

Name: Washington State Auditor's Office
norm: washington state auditor s office

Name: Washington State Auditor's Office
norm: washington state auditor s office
Industry: Governmentllm

Discovered: Jan 12, 2021
Breach occurred: Dec 1, 2020
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2021
Affected individuals: 1,420,520state-resident count only
Data types: EducationFinancial accountIdentity (basic)Government IDPHI
Data elements: NameSocial Security numberFinancial account numberDate of birthStudent ID numberHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Office of the Attorney General
Third party: via Accellion
Initial access: supply_chain

During the incident: Contacted Accellion for specific details
Mobilized its team to assess the data files that were impacted and the security of SAO's network
Working with cybersecurity experts
Retained a cybersecurity investigation firm
Notified law enforcement
Offered one year of free credit monitoring and identity restoration services through Experian
Published legal notices in five Washington State newspapers
Issued press releases
Kept its website up to date with information about the breach
Operated a dedicated call center through September 30, 2021
Changes made: Migrated to Accellion's newest secure file transfer platform, kiteworks, as of January 1, 2021
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10401.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2021
Raw hash: 93158561f7328c2c8dc2912f21bb2eacce72cbb78533a44df6f4686729fad61a

Reporting entityWashington State Auditor's Office

Victim entityWashington State Auditor's Office

Incidentdiscovered Jan 12, 2021

Stated responseContacted Accellion for specific details

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com