HackingVulnerability ExploitCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICHEALTH_BASICMINORMediumResolved
Northern California Children's Therapy Center
bd_30c1bc7466b2f97a · schema v1 · pii pii-v1
Full breach record for Northern California Children's Therapy Center →Northern California Children's Therapy Center (NCCTC) notified clients on April 24, 2025, of an unauthorized access incident occurring on March 16, 2025. An external actor exploited a vulnerability in a cloud-based file system used for the Help Me Grow Yolo County Program, accessing screening records containing names, contact info, and developmental health data for children and parents. No SSNs or financial data were exposed. NCCTC secured the system by March 19, 2025, and engaged cybersecurity experts.
California clockDiscovered Mar 16, 2025 → Notified Apr 24, 202539d ✓ CA 60-day OK6 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-601880
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 25, 2025
- Raw hash
- 443d4f7e8b0785fc4d9590ffa3de11954533c566c6fc8ccb1f353f23b7db942e
Reporting entity
- Name
- Northern California Children's Therapy Centernorm: northern california children s therapy center
Victim entity
- Name
- Northern California Children's Therapy Centernorm: northern california children s therapy center
Incident
- Discovered
- Mar 16, 2025
- Materiality determined
- —
- Notification sent
- Apr 24, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASICMINOR
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(40 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 39d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 16, 2025→ Notified: Apr 24, 202539d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.