HackingGovernmentGovernmentData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Health (basic)Financial accountCredentialsMediumContained

City of Grass Valley

bd_3ce265a2f8ca8529 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 7, 2022

To disclose

—

Affected

Not disclosed

Confidence

63%

City of Grass Valley reported unauthorized access to computer systems between April 13, 2021, and July 1, 2021. An unauthorized person transferred files containing PII, including SSNs, driver's license numbers, and limited health/financial data for employees, vendors, and police/community development department applicants. The city secured the network, engaged law enforcement and a cybersecurity firm, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 13, 2021

Begins

Jan 7, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: City of Grass Valley
norm: city of grass valley
Domain: downtowngrassvalley.com

Name: City of Grass Valley
norm: city of grass valley
Domain: downtowngrassvalley.com
Industry: Governmentllm

Discovered: —
Breach occurred: Apr 13, 2021 – Jul 1, 2021
Materiality determined: —
Notification sent: Jan 7, 2022
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Health (basic)Financial accountCredentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Took steps to secure our network
Contacted law enforcement
Began an investigation with the assistance of a cybersecurity firm
Offering individuals whose Social Security number or driver’s license number was involved in the incident a complimentary one-year membership to Experian’s® IdentityWorksSM
Changes made: Review our systems
Taking steps to enhance our existing security protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-549778
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 7, 2022
Raw hash: 72497b74b05d0645eaa62f7ab1ca2d733776761013832138f3f9ede6a7d739ca

Reporting entityCity of Grass Valley

Victim entityCity of Grass Valley

IncidentUnauthorized Access

Stated responseTook steps to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov