MalwareTechnologyInformationRansomwareCapture Stored DataData EncryptedData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

OmniVision Technologies, Inc.

bd_4eaa4454379dadad · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 30, 2023

Filed

May 17, 2024

To disclose

33 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for OmniVision Technologies, Inc. →

OmniVision Technologies, Inc. experienced a ransomware incident between September 4 and September 30, 2023, where an unauthorized third party encrypted systems and exfiltrated personal information. The company became aware of the incident on September 30, 2023. Affected individuals were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 30, 2023 → Notified May 17, 2024230d ✗ CA 60-day late33 weeks discovery → filing

Incident timeline

undetected · 26 days

discovery → filing · 33 weeks / 230 days

Sep 4, 2023

Begins

Sep 30, 2023

Discovered

May 17, 2024

Filed

vs. sector median

+14 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecactusbd_b73041d4d6f73f252023-09-26 · +234dVerified by operator

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_737e9d94a4f6d6ad2024-05-17Verified
Indiana State AGbd_c782ece14f15fac02024-05-17Verified
Massachusetts State AGbd_cb9631e9e1713a292024-05-17Verified by operator
Vermont State AGbd_5585086e39bebe112024-05-18 · +1dVerified by operator

Name: OmniVision Technologies, Inc.
norm: omnivision technologies

Name: OmniVision Technologies, Inc.
norm: omnivision technologies
Industry: Technologyllm

Discovered: Sep 30, 2023
Breach occurred: Sep 4, 2023 – Sep 30, 2023
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Launched a comprehensive investigation with the assistance of third-party cybersecurity experts
Notified law enforcement
Took proactive measures to remove the unauthorized party
Ensured the security of OVT systems
Changes made: Increased the number of monitoring solutions within our environment
Updating our security policies and procedures
Migrating certain systems to cloud-based operations
Requiring additional security awareness trainings within our organization
Offering complimentary credit monitoring and identity restoration services for 24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(230 days from discovery to filing)
Compliance flags: CA 60-day late · 230dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 30, 2023
→ Notified: May 17, 2024
230d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 30, 2023 → Notified: May 17, 2024	230d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGMay 17 · first

Indiana State AGMay 17 · first

Massachusetts State AGMay 17 · first

California State AGMay 17 · first · this page

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-585548
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2024
Raw hash: 912f755ed293b6162d3822bc5b7261367f9842ed134ea681e803668cb758958a

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityOmniVision Technologies, Inc.

Victim entityOmniVision Technologies, Inc.

Incidentdiscovered Sep 30, 2023

Stated responseLaunched a comprehensive investigation with the assistance of third-party cybersecurity experts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov