HackingGovernmentGovernmentData ExfiltratedData Leak ThreatenedEmployee Data InvolvedGovernment IDIdentity (basic)Financial accountHealth (basic)CredentialsMediumActive

California Department of Finance

bd_48972b6f910c8603 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 9, 2022

Filed

Dec 30, 2022

To disclose

21 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for California Department of Finance →

The California Department of Finance experienced a cybersecurity incident on December 6, 2022, where data was unlawfully obtained from its servers. The intrusion was identified proactively through coordination with security partners. The incident potentially affected personnel data for a small number of former employees, including names, SSNs, employee IDs, home addresses, phone numbers, bank account information, and medical information. There was a threat to release the obtained data. The department engaged threat-hunting experts and is providing credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 9, 2022 → Notified Dec 16, 20227d ✓ CA 60-day OK21 days discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 21 days

Dec 6, 2022

Begins

Dec 9, 2022

Discovered

Dec 30, 2022

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_6ea5048c835f23322022-12-12 · +18dCandidate

Name: California Department of Finance
norm: california department of finance
Domain: dof.ca.gov

Name: California Department of Finance
norm: california department of finance
Domain: dof.ca.gov
Industry: Governmentllm

Discovered: Dec 9, 2022
Breach occurred: Dec 6, 2022
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 16, 2022
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountHealth (basic)Credentials
Data elements: Social Security numberMedical information
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Deployed digital security and online threat-hunting experts to assess the extent of the intrusion
Coordinated with state and federal security partners including the California Cybersecurity Integration Center
Provided free subscription to Equifax – ID Watchdog Services for up to one year
Changes made: Review and revise technology procedures and practices to minimize the risk of recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: CA 60-day OK · 7d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 9, 2022
→ Notified: Dec 16, 2022
7d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 9, 2022 → Notified: Dec 16, 2022	7d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-560562
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2022
Raw hash: 017c38c7d351ae47c637231d71e5ead0c298df8e4a3795408b24f094fd6630cc

Linked disclosures

Ransomware claims (1)

Reporting entityCalifornia Department of Finance

Victim entityCalifornia Department of Finance

Incidentdiscovered Dec 9, 2022

Stated responseDeployed digital security and online threat-hunting experts to assess the extent of the intrusion

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov