HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
ChildNet Youth and Family Services
bd_1e113c0f606653fe · schema v1 · pii pii-v1
Full breach record for ChildNet Youth and Family Services →ChildNet Youth and Family Services, Inc. disclosed that an unauthorized individual accessed data maintained by its third-party vendor, Paycom, on or around April 24, 2023. The organization discovered the incident on June 26, 2023, following a forensic investigation. The breach involved names, addresses, and Social Security numbers. ChildNet engaged external cybersecurity professionals and is providing 12 months of credit monitoring and fraud assistance to affected individuals.
California clockDiscovered Jun 26, 2023 → Notified Jul 14, 202318d ✓ CA 60-day OK17 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_ea2f682d76fd96ddMaine State AGfiled 2023-07-13Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-570251
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 13, 2023
- Raw hash
- 5126787146db8fd264920442764865e84bfa431bb3d93a248737c0731ee5d82a
Reporting entity
- Name
- ChildNet Youth and Family Servicesnorm: childnet youth and family
Victim entity
- Name
- ChildNet Youth and Family Servicesnorm: childnet youth and family
Incident
- Discovered
- Jun 26, 2023
- Materiality determined
- —
- Notification sent
- Jul 14, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via Paycom
- Initial access
- supply_chain
Compliance
- Time to disclose
- 17 days(17 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 18d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 26, 2023→ Notified: Jul 14, 202318d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.