AccidentalFinancial ServicesProfessional ServicesFinanceMisdeliveryCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDMediumResolved

AccessLex Institute

bd_252d53a7098baa46 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2018

Filed

Apr 18, 2018

To disclose

21 days

Affected

Not disclosed

Confidence

65%

Full breach record for AccessLex Institute →3 incidents on file

AccessLex Institute d/b/a Access Group notified the California Attorney General that a vendor inadvertently sent loan files containing names, driver's license numbers, and Social Security numbers to an unauthorized business on March 23, 2018. The company learned of the incident on March 28, 2018. The unauthorized recipient confirmed deletion of the files. AccessLex is offering one year of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 21 days

Mar 23, 2018

Begins

Mar 28, 2018

Discovered

Apr 18, 2018

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: AccessLex Institute
norm: accesslex institute

Name: AccessLex Institute
norm: accesslex institute
Also named: AccessLex Institutedba oflegal entity
Access Groupdba oftrade name
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Mar 28, 2018
Breach occurred: Mar 23, 2018
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
Third party: via Student loan processing vendor

During the incident: Contacted managers of the second business that received the files
Arranged for complimentary one-year membership of Experian’s IdentityWorks Credit 3B
Changes made: Continue to communicate to its vendors that they must have written data transfer protocols in place
Train their employees to verify the identity of planned recipients of data transfers before the vendors transfer data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-135410
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2018
Raw hash: 80be2856be7b355f6bbe5319456542bfb61755704d6f0e63be9a48877cf5e27d

Reporting entityAccessLex Institute

Victim entityAccessLex Institute

Incidentdiscovered Mar 28, 2018

Stated responseContacted managers of the second business that received the files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov