HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)LowContained

VENTURA COUNTY CREDIT UNION

bd_2938265eee90064b · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 14, 2022

Filed

Jul 6, 2023

To disclose

29 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for VENTURA COUNTY CREDIT UNION →3 incidents on file

Ventura County Credit Union experienced unauthorized access to certain employee email accounts from October 20, 2022, to December 15, 2022. The incident was discovered on December 14, 2022. The investigation determined that the affected accounts contained names and other basic identity information of members. VCCU engaged third-party forensic specialists, reviewed affected accounts, and is providing complimentary credit monitoring and identity protection services through Experian. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 14, 2022 → Notified Jul 6, 2023204d ✗ CA 60-day late29 weeks discovery → filing

Incident timeline

undetected · 55 days

discovery → filing · 29 weeks / 204 days

Oct 20, 2022

Begins

Dec 14, 2022

Discovered

Jul 6, 2023

Filed

vs. sector median

+21 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_23bda900e7453dca2023-07-06Verified
Oregon State AGbd_3b9430e297d5c6a52023-07-06Verified by operator
Indiana State AGbd_8a2508b659eeb2cf2023-07-06Verified
Montana State AGbd_8f90a18471b31b252023-07-06Verified

Show 1 more filing ↓

Maine State AGbd_ce00bddf2f7c60192023-07-06Verified by operator

Name: VENTURA COUNTY CREDIT UNION
norm: ventura county credit union
Domain: vccuonline.net

Name: VENTURA COUNTY CREDIT UNION
norm: ventura county credit union
Domain: vccuonline.net
Industry: Financial Servicesllm

Discovered: Dec 14, 2022
Breach occurred: Oct 20, 2022 – Dec 15, 2022
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 6, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Reviewed the contents of the affected accounts to determine what sensitive information they contained
Providing access to credit monitoring and identity protection services through Experian at no cost
Changes made: Taking steps to implement additional safeguards
Reviewing policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(204 days from discovery to filing)
Compliance flags: CA 60-day late · 204d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 14, 2022
→ Notified: Jul 6, 2023
204d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 14, 2022 → Notified: Jul 6, 2023	204d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGJul 6 · first

Oregon State AGJul 6 · first

Indiana State AGJul 6 · first

Montana State AGJul 6 · first

Maine State AGJul 6 · first

California State AGJul 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-569315
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 6, 2023
Raw hash: 35f666a7fc27e8348890a2394145cd8368fec942072bcc8dbb7d6a9cfcae4586

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityVENTURA COUNTY CREDIT UNION

Victim entityVENTURA COUNTY CREDIT UNION

Incidentdiscovered Dec 14, 2022

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov