HackingData MishandlingData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICLowContained
The Devereux Foundation
bd_3e7a87e5cb2ef0cc · schema v1 · pii pii-v1
Full breach record for The Devereux Foundation →Devereux Foundation reported that an unauthorized actor gained access to certain systems from November 6-9, 2025, and copied files. The incident was identified on November 9, 2025. Affected data includes names and other personal information of employees, beneficiaries, clients, donors, payors, and business partners. The organization engaged third-party specialists, notified regulators and law enforcement, and is offering credit monitoring.
California clockDiscovered Nov 9, 2025 → Notified Jul 23, 2026256d ✗ CA 60-day late37 weeks discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_30438f60791408cfTexas State AGfiled 2026-07-23Verified
- bd_60ba0e09106cc119Vermont State AGfiled 2026-07-23Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-626965
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 23, 2026
- Raw hash
- 39f0ecbdfb238645fb3c1c02fac2c13fad54140e4af5474a49f182e32f4f753c
Reporting entity
- Name
- The Devereux Foundationnorm: the devereux
Victim entity
- Name
- The Devereux Foundationnorm: the devereux
Incident
- Discovered
- Nov 9, 2025
- Materiality determined
- —
- Notification sent
- Jul 23, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified relevant regulatorsNotified law enforcement
Compliance
- Time to disclose
- 37 weeks(256 days from discovery to filing)
- Compliance flags
- CA 60-day late · 256dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 9, 2025→ Notified: Jul 23, 2026256d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Jul 23, 2026→ AG copy submitted: Jul 23, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.