Social EngineeringTechnologyInformationPhishingEmployee Data InvolvedTargetedGovernment IDIdentity (basic)EmploymentFinancial accountMediumContained

RENOVATE AMERICA HOLDINGS, LLC

bd_5dfb7ef5d34b00f0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2017

Filed

Feb 3, 2017

To disclose

14 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for RENOVATE AMERICA HOLDINGS, LLC →

Renovate America, Inc. disclosed an email spoofing attack on January 20, 2017, where an attacker impersonated the CEO to request employee W-2 forms. Employee W-2s containing names, addresses, SSNs, and wage information were sent to the fraudulent account. The company discovered the fraud within hours, contacted the FBI and IRS, and offered 24 months of identity protection via Experian. No network compromise occurred.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 20, 2017 → Notified Jan 20, 20170d ✓ CA 60-day OK14 days discovery → filing

Incident timeline

discovery → filing · 14 days

Jan 20, 2017

Begins

Jan 20, 2017

Discovered

Feb 3, 2017

Filed

vs. sector median

17 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_26137debbd4bcb682017-02-03Verified

Name: RENOVATE AMERICA HOLDINGS, LLC
norm: renovate america

Name: RENOVATE AMERICA HOLDINGS, LLC
norm: renovate america
Industry: Technologyllm

Discovered: Jan 20, 2017
Breach occurred: Jan 20, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 20, 2017
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)EmploymentFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Contacted the IRSContacted the FBIContacting the relevant state Attorneys General
Initial access: phishing_link

During the incident: Discovered the fraudulent nature of the request within a few hours
Working tirelessly to investigate and to mitigate the impact of the attack
Contacted the IRS and FBI
Contacting the relevant state Attorneys General
Arranged for Experian to protect identity for 24 months at no cost
Changes made: Implementing additional safeguards
Providing additional mandatory training to employees on safeguarding the privacy and security of information on our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 60-day OK · 0d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 20, 2017
→ Notified: Jan 20, 2017
0d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 20, 2017 → Notified: Jan 20, 2017	0d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 3 · first

California State AGFeb 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66165
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2017
Raw hash: eff6a9aabd78cb6f98d4751726acb2359ae37813a0e3d87aa675df83822dc430

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRENOVATE AMERICA HOLDINGS, LLC

Victim entityRENOVATE AMERICA HOLDINGS, LLC

Incidentdiscovered Jan 20, 2017

Stated responseDiscovered the fraudulent nature of the request within a few hours

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov