AccidentalTechnologyFinancial ServicesInformationMisdeliveryEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentFinancial accountMediumResolved

ORACLE CORPORATION

bd_4ceeb70dbe4347dd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 10, 2013

Filed

Jul 31, 2013

To disclose

21 days

Affected

Not disclosed

Confidence

64%

Full breach record for ORACLE CORPORATION →2 incidents on file

Fidelity Investments, acting as a retirement plan administrator for Oracle Corporation, inadvertently included Oracle employee data in a report viewed by an administrator at another Fidelity client firm on July 10, 2013. The report contained names, Social Security numbers, compensation, and 401(k) details. The unauthorized viewer promptly returned and deleted the report. Fidelity deleted the report from the application and strengthened administrative controls. No misuse was known.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 10, 2013 → Notified Jul 31, 201321d ✓ CA 60-day OK21 days discovery → filing

Incident timeline

discovery → filing · 21 days

Jul 10, 2013

Begins

Jul 10, 2013

Discovered

Jul 31, 2013

Filed

vs. sector median

16 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Fidelity Investments
norm: fidelity investments
Domain: fidelity.com

Name: ORACLE CORPORATION
norm: oracle
Industry: TechnologyllmFinancial Servicesllm

Discovered: Jul 10, 2013
Breach occurred: Jul 10, 2013
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2013
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)EmploymentFinancial account
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal
Third party: via Fidelity Investments

During the incident: Immediately deleted the report from the password-protected application
Cooperated with the unauthorized viewer in the return and deletion of the report
Changes made: Taken steps to further strengthen administrative control procedures to help prevent a recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: CA 60-day OK · 21d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 10, 2013
→ Notified: Jul 31, 2013
21d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 10, 2013 → Notified: Jul 31, 2013	21d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-42364
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2013
Raw hash: efc679dcc637a2f6918c22c9668c33ed0001b87e3e9377f3870089f3c3e29016

Reporting entityFidelity Investments

Victim entityORACLE CORPORATION

Incidentdiscovered Jul 10, 2013

Stated responseImmediately deleted the report from the password-protected application

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov