Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
CPT Group, Inc.
bd_4a1db9b56411442e · schema v1 · pii pii-v1
Full breach record for CPT Group, Inc. →CPT Group, Inc. notified California regulators of a phishing incident where an employee's email account was accessed by an unauthorized individual from November 22, 2017, through December 8, 2017. The breach potentially exposed the names, addresses, and Social Security numbers of class members from a settlement. CPT implemented multi-factor authentication, retrained employees, and provided one year of complimentary identity monitoring through Kroll.
California clockDiscovered Feb 8, 2018 → Notified Apr 27, 201878d ✗ CA 60-day late11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-135709
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 27, 2018
- Raw hash
- ed817ca01d894ab555100874d44f2f8adc2b51df887c4f59b6246f563f2c1ebd
Reporting entity
- Name
- CPT Group, Inc.norm: cpt group
Victim entity
- Name
- CPT Group, Inc.norm: cpt group
Incident
- Discovered
- Feb 8, 2018
- Materiality determined
- —
- Notification sent
- Apr 27, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 11 weeks(78 days from discovery to filing)
- Compliance flags
- CA 60-day late · 78d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 8, 2018→ Notified: Apr 27, 201878d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.