HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

ChildNet Youth and Family Services

bd_1e113c0f606653fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2023

Filed

Jul 13, 2023

To disclose

17 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for ChildNet Youth and Family Services →

ChildNet Youth and Family Services, Inc. disclosed that an unauthorized individual accessed data maintained by its third-party vendor, Paycom, on or around April 24, 2023. The organization discovered the incident on June 26, 2023, following a forensic investigation. The breach involved names, addresses, and Social Security numbers. ChildNet engaged external cybersecurity professionals and is providing 12 months of credit monitoring and fraud assistance to affected individuals.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date17 days discovery → filing

Incident timeline

undetected · 63 days

discovery → filing · 17 days

Apr 24, 2023

Begins

Jun 26, 2023

Discovered

Jul 13, 2023

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_ea2f682d76fd96dd2023-07-13Verified

Name: ChildNet Youth and Family Services
norm: childnet youth and family

Name: ChildNet Youth and Family Services
norm: childnet youth and family
Industry: Professional Servicesllm

Discovered: Jun 26, 2023
Breach occurred: Apr 24, 2023
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 14, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Paycom
Initial access: supply_chain

During the incident: Commenced a prompt and thorough investigation
Working closely with external cybersecurity professionals
Conducted extensive forensic investigation and manual document review
Providing complimentary access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services
Providing proactive fraud assistance through Cyberscout through Identity Force
Changes made: Continually evaluate and modify practices to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGJul 13 · first

California State AGJul 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570251
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 13, 2023
Raw hash: 5126787146db8fd264920442764865e84bfa431bb3d93a248737c0731ee5d82a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityChildNet Youth and Family Services

Victim entityChildNet Youth and Family Services

Incidentdiscovered Jun 26, 2023

Stated responseCommenced a prompt and thorough investigation

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov