AccidentalMisdeliveryEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumResolved

Supreme

bd_765ba552845b0f51 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 22, 2018

Filed

Mar 26, 2018

To disclose

5 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for Supreme →

Paycor, Inc., a payroll service provider for Supreme Corporation, accidentally mailed an encrypted CD containing IRS W-2 tax information (names, addresses, SSNs) to an unrelated client on February 16, 2018. The error was discovered on February 22, 2018, when the recipient notified Paycor. The CD was securely returned and data deleted. Paycor retrained staff and adjusted QA processes. Identity theft protection was offered to affected Supreme Corporation employees.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 5 weeks / 32 days

Feb 16, 2018

Begins

Feb 22, 2018

Discovered

Mar 26, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Paycor
norm: paycor
Domain: paycor.com

Name: Supreme
norm: supreme
Domain: supreme.com

Discovered: Feb 22, 2018
Breach occurred: Feb 16, 2018
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Attack vector: Unknown
Threat actor: Internal
Third party: via Paycor, Inc.

During the incident: Retrained the Paycor associate who made this mistake
Adjusted process for creating CDs to require additional quality assurance testing
Offering one year of complimentary identity theft protection services
Changes made: Retrained the Paycor associate who made this mistake
Adjusted process for creating CDs to require additional quality assurance testing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134791
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2018
Raw hash: 06bb05b8a48b2f894385b29bbe2e5bbe35cc2f0e688a88f32540b35828b7b9a6

Reporting entityPaycor

Victim entitySupreme

Incidentdiscovered Feb 22, 2018

Stated responseRetrained the Paycor associate who made this mistake

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov