AccidentalEnergy & UtilitiesUtilitiesMisdeliveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Southern California Edison Co.

bd_26090920adfbfae8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 28, 2022

Filed

Dec 28, 2022

To disclose

4 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Southern California Edison Co. →

Southern California Edison notified the California AG of an inadvertent disclosure of retiree personal information (name, SSN, HRA contributions) on November 28, 2022. A Benefit Wallet representative accidentally emailed a report to another client. The error was discovered within 15 minutes, and the recipient destroyed the file and provided attestation. SCE offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 28, 2022 → Notified Dec 22, 202224d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

discovery → filing · 4 weeks / 30 days

Nov 28, 2022

Begins

Nov 28, 2022

Discovered

Dec 28, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Southern California Edison Co.
norm: southern california edison

Name: Southern California Edison Co.
norm: southern california edison
Industry: Energy & Utilitiesllm

Discovered: Nov 28, 2022
Breach occurred: Nov 28, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal
Third party: via Benefit Wallet

During the incident: Recipient removing and destroying the file
Recipient providing an attestation about such removal and destruction
Investigating to understand the incident, including the root cause, mitigation efforts, and corrective actions
Offering complimentary 12 months access to Equifax credit monitoring services
Changes made: Retrained its employees on proper data handling procedures
Reviewing the applicable processes and tools
Making appropriate changes to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 24d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 28, 2022
→ Notified: Dec 22, 2022
24d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 28, 2022 → Notified: Dec 22, 2022	24d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-560464
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 28, 2022
Raw hash: 37afcb3d7a1f022997803799351dc6a46445df6e6d917fe2acb04eca44da198c

Reporting entitySouthern California Edison Co.

Victim entitySouthern California Edison Co.

Incidentdiscovered Nov 28, 2022

Stated responseRecipient removing and destroying the file

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov