HackingVulnerability ExploitStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedEmployee Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTEMPLOYMENTMediumContained
Boot World
bd_63aae4596172a0e5 · schema v1 · pii pii-v1
Full breach record for Boot World →Boot World Inc. experienced a security breach via its third-party payroll provider, Paycom, on May 27, 2023. Unauthorized parties accessed employee data including names, SSNs, addresses, and banking information. The company notified employees on May 31, 2023, and is cooperating with the FBI. Identity theft protection was offered.
California clockDiscovered May 27, 2023 → Notified May 31, 20233d ✓ CA 60-day OK17 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-567947
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 13, 2023
- Raw hash
- 263bfa2b48001489f8d7930ed4f528a4dbfa5de77523903c8f857db8f68711b7
Reporting entity
- Name
- Boot Worldnorm: boot world
- Domain
- bootworld.com
Victim entity
- Name
- Boot Worldnorm: boot world
- Domain
- bootworld.com
Incident
- Discovered
- May 27, 2023
- Materiality determined
- —
- Notification sent
- May 31, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTEMPLOYMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1119 Automated CollectionT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Working with law enforcement and the FBI
- Third party
- via Paycom
- Initial access
- supply_chain
Compliance
- Time to disclose
- 17 days(17 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 3d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 27, 2023→ Notified: May 31, 20233d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.