HackingTechnologyInformationData ExfiltratedData PublishedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

The Computer Merchant, Ltd.

bd_2b56afa7cd461874 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2025

Filed

Aug 21, 2025

To disclose

33 weeks

Affected

Not disclosed

Linked

11 records

Confidence

66%

Full breach record for The Computer Merchant, Ltd. →

The Computer Merchant, Ltd. experienced a cyberattack in July 2024. In January 2025, the company became aware that data from the incident had been made publicly available. The breach involved names and Social Security numbers. The company secured its systems, engaged a data-review firm, and is offering identity-theft protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 1, 2025 → Notified Aug 19, 2025230d ✗ CA 60-day late33 weeks discovery → filing

Incident timeline

undetected · 184 days

discovery → filing · 33 weeks / 232 days

Jul 1, 2024

Begins

Jan 1, 2025

Discovered

Aug 21, 2025

Filed

vs. sector median

+22 wks slower

This filing is one of 11 records about the same incident.View merged incident

A leak claim by play about this victim was first seen 392 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_6d00600f90f10c7c2024-07-15 · +402dVerified

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_08dc2d6569d825102025-08-21Verified
Massachusetts State AGbd_29c30c22f0deaab42025-08-21Verified
Washington State AGbd_785d79b5b8ebd3b32025-08-21Verified
Maine State AGbd_dfa81e3bb03611292025-08-21Verified

Show 5 more filings ↓up to 2d gap

Texas State AGbd_09053f36a57de9092025-08-22 · +1dVerified
Montana State AGbd_80c1facf470aa5792025-08-20 · +1dCandidate
Indiana State AGbd_0bc9cb0fb948677e2025-08-19 · +2dVerified
Vermont State AGbd_59bcb7c5698db8fd2025-08-19 · +2dVerified
Nebraska State AGbd_6282f30064c7ed082025-08-19 · +2dVerified

Name: The Computer Merchant, Ltd.
norm: the computer merchant
Domain: itstaffing.com

Name: The Computer Merchant, Ltd.
norm: the computer merchant
Domain: itstaffing.com
Industry: Technologyllm

Discovered: Jan 1, 2025
Breach occurred: Jul 1, 2024 – Jul 5, 2024
Undetected for: 184 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 19, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Promptly responded to secure and to restore our environment
Complete wipe and restore of our computer assets
Promptly worked to retrieve those files
Engaged a data-review firm to analyze those files’ contents
Changes made: Offering identity-theft-protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(232 days from discovery to filing)
Compliance flags: CA 60-day late · 230dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 1, 2025
→ Notified: Aug 19, 2025
230d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 1, 2025 → Notified: Aug 19, 2025	230d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Indiana State AGAug 19 · first

Vermont State AGAug 19 · first

Nebraska State AGAug 19 · first

Montana State AG+1d

New Hampshire State AG+2d

Massachusetts State AG+2d

Washington State AG+2d

Maine State AG+2d

California State AG+2d · this page

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-607506
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2025
Raw hash: a9c7c8c70fb920e55c48f5c17b8bc162b648c51d6e292c3e0ae5bdaf739f347c

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityThe Computer Merchant, Ltd.

Victim entityThe Computer Merchant, Ltd.

Incidentdiscovered Jan 1, 2025

Stated responsePromptly responded to secure and to restore our environment

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov