HackingGovernmentGovernmentCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

St Helena

bd_65346cb23136ac32 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 13, 2024

Filed

Aug 26, 2024

To disclose

15 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for St Helena →

The City of St. Helena detected unauthorized network activity on May 13, 2024, with the breach occurring between April 29 and May 13, 2024. An unauthorized third party accessed personal information including names, contact details, dates of birth, government IDs (SSN, driver's license), financial account details, and limited medical information. The city engaged cybersecurity experts and a data-review firm. Notices were sent on August 23, 2024. Some affected individuals were offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 13, 2024 → Notified Aug 23, 2024102d ✗ CA 60-day late15 weeks discovery → filing

Incident timeline

undetected · 14 days

discovery → filing · 15 weeks / 105 days

Apr 29, 2024

Begins

May 13, 2024

Discovered

Aug 26, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: City of St. Helena
norm: city of st helena
Domain: cityoflufkin.com

Name: St Helena
norm: st helena
Domain: sainthelena.gov.sh
Industry: Governmentllm

Discovered: May 13, 2024
Breach occurred: Apr 29, 2024 – May 13, 2024
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 23, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Detected unauthorized activity on our network
Began investigating to determine the scope of the incident
Working with cybersecurity experts on remediation
Engaged a data-review firm to review the content of those files
Hired third-party experts to help us address this situation
Worked with us to further secure our systems
Changes made: Further secure our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: CA 60-day late · 102d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 13, 2024
→ Notified: Aug 23, 2024
102d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 13, 2024 → Notified: Aug 23, 2024	102d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-590801
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2024
Raw hash: a480c9ce771044f4df3834a1689cc7d36ab52d8b576d4c09ebef61c56e185c77

Reporting entityCity of St. Helena

Victim entitySt Helena

Incidentdiscovered May 13, 2024

Stated responseDetected unauthorized activity on our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov