Social EngineeringOtherPhishingStolen CredentialsCapture App DataMulti-Stage ChainCustomer Data InvolvedData ExfiltratedDelayed DiscoveryPIIPCIFinancialGovernment IDMediumActive

CHP 11-99 Foundation

bd_6a3a425bd0f43a40 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 1, 2026

To disclose

—

Affected

Not disclosed

Confidence

84%

Full breach record for CHP 11-99 Foundation →2 incidents on file

On or about September 16, 2025, a CHP 11-99 Foundation staff member clicked a phishing link after an external service provider's Help Desk incorrectly cleared it as safe. The attacker gained full access to the staff member's email account, including membership applications and payment documents containing bank/credit card information, driver's license numbers, Social Security numbers, names, addresses, and email addresses. Discovery occurred on September 24, 2025, when the attacker attempted to use the compromised account to phish the Help Desk.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 16, 2025

Begins

Apr 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CHP 11-99 Foundation
norm: chp 11 99

Name: CHP 11-99 Foundation
norm: chp 11 99
Industry: Otherllm

Discovered: —
Breach occurred: Sep 16, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPCIFinancialGovernment ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified California Office of the Attorney General per SB 24 data breach reporting requirements
Initial access: phishing_link

During the incident: Actively working with our retained incident response vendor to better understand the situation and the scope of the compromise
Worked with our vendors to identify the attack vector and hardened security with multifactor authentication, changed passwords, and a review of security protocols
Continuing to investigate the details of the incident
Secured the services of Kroll to provide identity monitoring services at no cost to you for twelve (12) months
Changes made: Hardened security with multifactor authentication
Changed passwords
Review of security protocols
Plan to change our IT and security service provider
Continue to follow the advice of the incident response team and counsel, and intend to continue to mitigate any discovered vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-621146
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 1, 2026
Raw hash: 284969ef8a19f7a8012a5b572d86be667e7dde1cdbc73a81c7164ce219efc59b

Reporting entityCHP 11-99 Foundation

Victim entityCHP 11-99 Foundation

IncidentPhishing

Stated responseActively working with our retained incident response vendor to better understand the situation and the scope of the compromise

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov