HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Thomas Safran & Associates
bd_658fb97e998d4c95 · schema v1 · pii pii-v1
Full breach record for Thomas Safran & Associates →Thomas Safran & Associates notified the California Attorney General of a data security incident identified on September 8, 2025. An unauthorized party accessed a computer server containing confidential information, including names, dates of birth, addresses, and Social Security Numbers. The company engaged forensic experts, secured the environment, and is offering 12 months of credit monitoring to affected individuals in California, New Mexico, New York, North Carolina, Oregon, and Rhode Island.
California clockDiscovered Sep 8, 2025 → Notified Nov 24, 202577d ✗ CA 60-day late11 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_a296f580a5004dd1Leak Siteplayfiled 2025-09-07(78d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-614738
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 24, 2025
- Raw hash
- 80f8c7489f021e12e98050a261755d2b7c838c0f308764d276e176e5b3a3566e
Reporting entity
- Name
- Thomas Safran & Associatesnorm: thomas safran associates
- Domain
- tsahousing.com
Victim entity
- Name
- Thomas Safran & Associatesnorm: thomas safran associates
- Domain
- tsahousing.com
Incident
- Discovered
- Sep 8, 2025
- Materiality determined
- —
- Notification sent
- Nov 24, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 11 weeks(77 days from discovery to filing)
- Compliance flags
- CA 60-day late · 77d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 8, 2025→ Notified: Nov 24, 202577d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.