HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Alcott HR

bd_23e2e2662dd975b0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2025

Filed

Jun 17, 2026

To disclose

16 months

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Alcott HR →

Alcott notified the California Attorney General of a data security incident where an unauthorized user accessed systems containing personal information. The breach was discovered in February 2025. Affected data includes names, Social Security Numbers, and dates of birth. Alcott engaged forensic experts, notified law enforcement, and is offering 24 months of identity theft protection. Remediation steps include enhanced monitoring, firewall strengthening, and MFA policy reinforcement.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 12, 2025 → Notified Jun 15, 2026488d ✗ CA 60-day late16 months discovery → filing

Incident timeline

discovery → filing · 16 months / 490 days

Feb 12, 2025

Begins

Feb 12, 2025

Discovered

Jun 17, 2026

Filed

vs. sector median

+52 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_c1a64772c67381122025-02-25 · +476dVerified

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_05d93b4ec049bf842026-06-17Verified
Nebraska State AGbd_b5af6a27d6702fe22026-06-17Verified
Vermont State AGbd_c8d2e4907177c37d2026-06-17Verified
New Hampshire State AGbd_01d619ed5ce88bff2026-06-22 · +5dVerified

Show 1 more filing ↓up to 6d gap

Massachusetts State AGbd_69ca5b1c0c2565be2026-06-23 · +6dVerified

Name: Alcott HR
norm: alcott hr
Domain: alcotthr.com

Name: Alcott HR
norm: alcott hr
Domain: alcotthr.com
Industry: Professional Servicesllm

Discovered: Feb 12, 2025
Breach occurred: Feb 12, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unknown
Threat actor: External
Regulator citations: Reported the circumstances to law enforcement

During the incident: Implemented incident response protocols
Reported the circumstances to law enforcement
Engaged independent computer forensic experts to assist with conducting a thorough investigation
Offering identity theft protection services through Cyberscout for 24 months
Changes made: Improving vendor support and security
Enhancing threat detecting and endpoint monitoring tools utilized in our IT environment
Strengthening firewalls
Conducting third-party review of our configuration details
Reemphasized password and multifactor authentication policies
Working with our IT and security experts to further enhance our security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(490 days from discovery to filing)
Compliance flags: CA 60-day late · 488dLeak >180dCA AG copy ≤15d · 2d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 12, 2025
→ Notified: Jun 15, 2026
488d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Jun 15, 2026
→ AG copy submitted: Jun 17, 2026
2d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 12, 2025 → Notified: Jun 15, 2026	488d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Jun 15, 2026 → AG copy submitted: Jun 17, 2026	2d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGJun 17 · first

Nebraska State AGJun 17 · first

Vermont State AGJun 17 · first

California State AGJun 17 · first · this page

New Hampshire State AG+5d

Massachusetts State AG+6d

Pattern: first filing Jun 17 (IN), last Jun 23 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-625037
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2026
Raw hash: 7e6a428fc3f23de9a7f28b06c2c44da4574fd1ad2886eb8be88939896ab95cb6

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityAlcott HR

Victim entityAlcott HR

Incidentdiscovered Feb 12, 2025

Stated responseImplemented incident response protocols

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov