Social EngineeringGovernmentGovernmentPhishingStolen CredentialsData ExfiltratedTargetedPIIIdentity (basic)LowContained

Oklahoma City Housing Authority

bd_3f16407b4535b165 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 21, 2021

Filed

Jul 22, 2022

To disclose

30 weeks

Affected

3state residents only

Linked

5 filings

Confidence

65%

Full breach record for Oklahoma City Housing Authority →

Oklahoma City Housing Authority (OCHA) notified individuals of unauthorized access to email accounts between Nov 30 and Dec 21, 2021. OCHA discovered the incident on Dec 21, 2021, after unauthorized emails were sent from an OCHA account. The incident likely involved access to files containing names and other PII. OCHA engaged forensic specialists and is offering credit monitoring. Notifications were sent in July 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 30 weeks / 213 days

Nov 30, 2021

Begins

Dec 21, 2021

Discovered

Jul 22, 2022

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_b02c82f0bb5958ca2022-07-22Verified
Maine State AGbd_d4a0cc70f4e760c92022-07-22Verified by operator
Indiana State AGbd_d87234b11bbc12932022-07-22Verified
New Hampshire State AGbd_7f0692e4871fa84f2022-07-26 · +4dVerified

Name: Oklahoma City Housing Authority
norm: oklahoma city housing authority
Domain: ochanet.org

Name: Oklahoma City Housing Authority
norm: oklahoma city housing authority
Domain: ochanet.org
Industry: Governmentllm

Discovered: Dec 21, 2021
Breach occurred: Nov 30, 2021 – Dec 21, 2021
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 22, 2022
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Offering [Extra3] months of complimentary access to identity monitoring services through Experian
Changes made: Reviewed our existing systems and policies and implemented additional safeguards to further secure the information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(213 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 22 · first

Maine State AGJul 22 · first

Indiana State AGJul 22 · first

Montana State AGJul 22 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2022
Raw hash: 408e7b882f6766bed8f189b46d10f162e57c9c5e1b98ebb0112aed6e6be8c9c4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOklahoma City Housing Authority

Victim entityOklahoma City Housing Authority

Incidentdiscovered Dec 21, 2021

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov