HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountAuthenticationMediumContained

San Francisco Employees' Retirement System

bd_34fd5fd9333f9b8f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2020

Filed

Jun 9, 2020

To disclose

11 weeks

Affected

74,000

Confidence

64%

Full breach record for San Francisco Employees' Retirement System →

San Francisco Employees' Retirement System (SFERS) notified the California AG of a data breach involving its vendor, 10up Inc. On Feb 24, 2020, an outside party accessed a test server containing data for ~74,000 SFERS members. The vendor discovered the access on March 21, 2020, and notified SFERS on March 26, 2020. Exposed data included names, addresses, dates of birth, beneficiary info, and for registered users, security questions/answers and bank routing numbers. SSNs were not involved. SFERS reset passwords and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 21, 2020 → Notified Mar 26, 20205d ✓ CA 60-day OK11 weeks discovery → filing

Incident timeline

undetected · 26 days

discovery → filing · 11 weeks / 80 days

Feb 24, 2020

Begins

Mar 21, 2020

Discovered

Jun 9, 2020

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed74,000 affectedView incident

Name: San Francisco Employees' Retirement System
norm: san francisco employees retirement system
Domain: mysfers.org

Name: San Francisco Employees' Retirement System
norm: san francisco employees retirement system
Domain: mysfers.org
Industry: Financial Servicesllm

Discovered: Mar 21, 2020
Breach occurred: Feb 24, 2020
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2020
Affected individuals: 74,000nationwide
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via 10up Inc.

During the incident: 10Up locked the server
SFERS has implemented a password reset requirement for all members logging into the SFERS website
Changes made: Offering a complimentary one-year membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: CA 60-day OK · 5d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 21, 2020
→ Notified: Mar 26, 2020
5d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 21, 2020 → Notified: Mar 26, 2020	5d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190732
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 9, 2020
Raw hash: 3ba3bbdcd433ffb3b5a6e1cffd61c835f0e0135d7a7b0426985fb58a4c6f5fd1

Reporting entitySan Francisco Employees' Retirement System

Victim entitySan Francisco Employees' Retirement System

Incidentdiscovered Mar 21, 2020

Stated response10Up locked the server

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov