DisclosureLens
HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDEducationMediumContained

SILICON VALLEY COMMUNITY FOUNDATION

bd_3f952b9232348059 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 1, 2019

Filed

Apr 20, 2020

To disclose

20 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%
Full breach record for SILICON VALLEY COMMUNITY FOUNDATION

Silicon Valley Community Foundation (SVCF) disclosed that unauthorized access occurred to email accounts containing personally identifiable information. Initial suspicious activity was detected on August 23, 2018, involving three compromised email accounts. In December 2019, SVCF discovered that one of these compromised mailboxes had access to a larger shared mailbox used for collecting scholarship information, potentially exposing names, addresses, photos, passport numbers, driver's license numbers, and school records. SVCF offered one year of complimentary credit monitoring to affected individuals.

Incident timeline

undetected · 465 days
discovery → filing · 20 weeks / 141 days

Aug 23, 2018

Begins

Dec 1, 2019

Discovered

Apr 20, 2020

Filed

vs. sector median

+3 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Indiana State AGApr 20 · first
Massachusetts State AGApr 20 · first
Montana State AGApr 20 · first
California State AGApr 20 · first · this page

Pattern: first filing Apr 20 (IN), last Apr 25 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.