HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

HILT-Trust 2020-A and its underlying trusts and affiliates

bd_6d319b375a381c5c · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jul 23, 2026

Filed

Sep 24, 2026

To disclose

9 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

68%

Full breach record for HILT-Trust 2020-A and its underlying trusts and affiliates →

HILT-Trust 2020-A notified individuals of a cybersecurity incident where an unauthorized third party accessed employee user accounts between July 23 and July 25, 2026. The breach exposed names, dates of birth, Social Security numbers, and loan details. HILT engaged external experts, contained the activity, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 23, 2026 → Notified Sep 9, 202648d ✗ CA 30-day late9 weeks discovery → filing

Incident timeline

discovery → filing · 9 weeks / 63 days

Jul 23, 2026

Begins

Jul 23, 2026

Discovered

Sep 24, 2026

Filed

vs. sector median

+1 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Texas State AGbd_61faa05495705f5c2026-09-09 · +15dCandidate

Name: HILT-Trust 2020-A and its underlying trusts and affiliates
norm: hilt trust 2020 a and its underlying trusts and affiliates

Name: HILT-Trust 2020-A and its underlying trusts and affiliates
norm: hilt trust 2020 a and its underlying trusts and affiliates
Industry: Financial Servicesllm

Discovered: Jul 23, 2026
Breach occurred: Jul 23, 2026 – Jul 25, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 9, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the matter to law enforcement
Initial access: valid_credentials

During the incident: Took steps to contain the activity
Implemented its incident response protocols
Launched an investigation with the assistance of external cybersecurity experts
Reported the matter to law enforcement
Engaged Equifax to provide two years of credit and identity monitoring services
Changes made: Taken a range of steps to enhance our existing security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: CA 30-day late · 48dCA AG copy ≤15d · 15d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 23, 2026
→ Notified: Sep 9, 2026
48d 30 calendar days CA 30-day late
California
Consumers notified: Sep 9, 2026
→ AG copy submitted: Sep 24, 2026
15d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 23, 2026 → Notified: Sep 9, 2026	48d	30 calendar days	CA 30-day late
California	Consumers notified: Sep 9, 2026 → AG copy submitted: Sep 24, 2026	15d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Texas State AGSep 9 · first

California State AG+15d · this page

Pattern: first filing Sep 9 (TX), last Sep 24 (CA) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-630200
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 24, 2026
Raw hash: 1586302d5a1312a0e8fa2d085ca73a791aef6976b0b1eea349a2c41c29a77662

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHILT-Trust 2020-A and its underlying trusts and affiliates

Victim entityHILT-Trust 2020-A and its underlying trusts and affiliates

Incidentdiscovered Jul 23, 2026

Stated responseTook steps to contain the activity

ComplianceCA 30-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov