Social EngineeringHealthcareTechnologyHealthcarePhishingStolen CredentialsEmployee Data InvolvedIdentity (basic)EmploymentLowContained

DYNAVAX TECHNOLOGIES CORPORATION

bd_6aec7d7ce2f1a0b7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 28, 2020

Filed

Jul 24, 2020

To disclose

21 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for DYNAVAX TECHNOLOGIES CORPORATION →2 incidents on file

Dynavax Technologies Corporation reported a phishing incident where an unauthorized individual accessed an employee's email account on February 28, 2020. The company secured the account, engaged forensic investigators, and reviewed emails. Employee information was potentially exposed, but no evidence of misuse was found. Affected individuals were offered one year of complimentary identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 28, 2020 → Notified Jul 24, 2020147d ✗ CA 60-day late21 weeks discovery → filing

Incident timeline

discovery → filing · 21 weeks / 147 days

Feb 28, 2020

Begins

Feb 28, 2020

Discovered

Jul 24, 2020

Filed

vs. sector median

+8 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: DYNAVAX TECHNOLOGIES CORPORATION
norm: dynavax technologies

Name: DYNAVAX TECHNOLOGIES CORPORATION
norm: dynavax technologies
Industry: HealthcarellmTechnologyllm

Discovered: Feb 28, 2020
Breach occurred: Feb 28, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 24, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Employment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Immediately secured the account
Engaged a leading computer forensic firm to assist with the investigation
Changed the credentials for the account
Taken steps to further increase security and protect our systems
Changes made: Offering a complimentary one-year membership of Experian’s IdentityWorks Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(147 days from discovery to filing)
Compliance flags: CA 60-day late · 147d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 28, 2020
→ Notified: Jul 24, 2020
147d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 28, 2020 → Notified: Jul 24, 2020	147d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192386
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 24, 2020
Raw hash: 454776a3c1af2d9b93ea325f8b76b6ec4d124eb2277cd29c4e2bbd86c1a778aa

Reporting entityDYNAVAX TECHNOLOGIES CORPORATION

Victim entityDYNAVAX TECHNOLOGIES CORPORATION

Incidentdiscovered Feb 28, 2020

Stated responseImmediately secured the account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov