HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTAUTHENTICATIONMediumContained
California Public Employees' Retirement System
bd_34fd5fd9333f9b8f · schema v1 · pii pii-v1
Full breach record for California Public Employees' Retirement System →San Francisco Employees' Retirement System (SFERS) notified the California AG of a data breach involving its vendor, 10up Inc. On Feb 24, 2020, an outside party accessed a test server containing data for ~74,000 SFERS members. The vendor discovered the access on March 21, 2020, and notified SFERS on March 26, 2020. Exposed data included names, addresses, dates of birth, beneficiary info, and for registered users, security questions/answers and bank routing numbers. SSNs were not involved. SFERS reset passwords and offered credit monitoring.
California clockDiscovered Mar 21, 2020 → Notified Mar 26, 20205d ✓ CA 60-day OK11 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed74,000 affectedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-190732
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 9, 2020
- Raw hash
- 3ba3bbdcd433ffb3b5a6e1cffd61c835f0e0135d7a7b0426985fb58a4c6f5fd1
Reporting entity
- Name
- California Public Employees' Retirement Systemnorm: california public employees retirement system
- Domain
- mysfers.org
Victim entity
- Name
- California Public Employees' Retirement Systemnorm: california public employees retirement system
- Domain
- mysfers.org
Incident
- Discovered
- Mar 21, 2020
- Materiality determined
- —
- Notification sent
- Mar 26, 2020
- Affected individuals
- 74,000
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTAUTHENTICATION
- Attack vector
- Third-Party / Supply Chain
- Threat actor
- External
- Third party
- via 10up Inc.
Compliance
- Time to disclose
- 11 weeks(80 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 5d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 21, 2020→ Notified: Mar 26, 20205d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.