MalwareTelecom & MediaInformationRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

SFJAZZ (San Francisco Jazz Organization)

bd_2b635014f36212de · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2023

Filed

Sep 18, 2023

To disclose

17 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for SFJAZZ (San Francisco Jazz Organization) →2 incidents on file

San Francisco Jazz Organization experienced a ransomware attack on May 23, 2023, which encrypted critical systems including file servers and backups. Forensic investigation revealed potential access to employee personal information, including names, Social Security Numbers, driver's license numbers, and dates of birth. The organization engaged third-party experts, contained the incident, and implemented enhanced security measures including two-factor authentication and encryption. Affected individuals were offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 23, 2023 → Notified Sep 15, 2023115d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

discovery → filing · 17 weeks / 118 days

May 23, 2023

Begins

May 23, 2023

Discovered

Sep 18, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_1cd2694cf115ef3a2023-09-15 · +3dCandidate
California State AGbd_01209b0af71b80872023-11-02 · +45dVerified

Name: SFJAZZ (San Francisco Jazz Organization)
norm: sfjazz san francisco jazz organization
Domain: sfjazz.org

Name: SFJAZZ (San Francisco Jazz Organization)
norm: sfjazz san francisco jazz organization
Domain: sfjazz.org
Industry: Telecom & Medianaics map

Discovered: May 23, 2023
Breach occurred: May 23, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 15, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Launched our incident response protocols to contain and mitigate the situation
Engaged third-party cybersecurity experts on June 1 to conduct a comprehensive forensic investigation
Changes made: Hardening our systems by installing industry leading countermeasures, such as enhanced encryption, for all sensitive devices
Fully updating security controls on users and their data
Implementing two-factor authentication across all of our systems and users
Offering complimentary access to Experian IdentityWorks for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: CA 60-day late · 115d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 23, 2023
→ Notified: Sep 15, 2023
115d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 23, 2023 → Notified: Sep 15, 2023	115d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Montana State AGSep 15 · first

California State AG+3d · this page

California State AG+48d

Pattern: first filing Sep 15 (MT), last Nov 2 (CA) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-573460
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2023
Raw hash: 2b58915db78ddf8712e95adf2cd3775ba935805dc8e595d8e1aa69c10fb062d7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySFJAZZ (San Francisco Jazz Organization)

Victim entitySFJAZZ (San Francisco Jazz Organization)

Incidentdiscovered May 23, 2023

Stated responseLaunched our incident response protocols to contain and mitigate the situation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov