HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICLowContained
Goodwill Industries of South Central California
bd_3e66537f97907ec9 · schema v1 · pii pii-v1
Full breach record for Goodwill Industries of South Central California →Goodwill Industries of South Central California notified individuals of unauthorized access to an employee email account discovered on July 21, 2022. The incident potentially exposed names and other personal data. The organization engaged forensic investigators, secured systems, and offered 12 months of credit monitoring.
California clockDiscovered Jul 21, 2022 → Notified Apr 7, 2023260d ✗ CA 60-day late42 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-566679
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 12, 2023
- Raw hash
- 9acdff9c5d0859289b0ebebdddcc9a4fe2f5e373b2656b54ed87aff951893960
Reporting entity
- Name
- Goodwill Industries of South Central Californianorm: goodwill industries of south central california
- Domain
- thegoodwill.org
Victim entity
- Name
- Goodwill Industries of South Central Californianorm: goodwill industries of south central california
- Domain
- thegoodwill.org
Incident
- Discovered
- Jul 21, 2022
- Materiality determined
- —
- Notification sent
- Apr 7, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 42 weeks(295 days from discovery to filing)
- Compliance flags
- CA 60-day late · 260d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 21, 2022→ Notified: Apr 7, 2023260d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.