HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
HRB Tax Group, Inc.
bd_1d95c96ac571a143 · schema v1 · pii pii-v1
Full breach record for HRB Tax Group, Inc. →H&R Block notified customers that an unauthorized third party used personally identifiable information obtained from external sources to access client accounts between May 13, 2024, and August 7, 2024. The incident was discovered on August 9, 2024. Affected data may include names, Social Security numbers, ITINs, government-issued ID numbers, financial account information, and dates of birth. H&R Block engaged third-party experts, terminated unauthorized access, and is offering 24 months of identity theft protection services.
California clockDiscovered Aug 9, 2024 → Notified Nov 26, 2024109d ✗ CA 60-day late20 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_981c4914b3bfe8e1Washington State AGfiled 2024-12-19(8d gap)Candidate
- bd_c0bc38fd204f3db0Maine State AGfiled 2024-12-19(8d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-596699
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 27, 2024
- Raw hash
- 1b79631bd2cacc38ece54d6b07a661cc171528ec115b3e0cb4c991d848c9d6bc
Reporting entity
- Name
- HRB Tax Group, Inc.norm: hrb tax
Victim entity
- Name
- HRB Tax Group, Inc.norm: hrb tax
Incident
- Discovered
- Aug 9, 2024
- Materiality determined
- —
- Notification sent
- Nov 26, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 20 weeks(140 days from discovery to filing)
- Compliance flags
- CA 60-day late · 109d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Aug 9, 2024→ Notified: Nov 26, 2024109d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.