HackingTelecom & MediaInformationVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)PIILowContained

The Washington Post

bd_78926bf02d97b8f8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2025

Filed

Jul 13, 2026

To disclose

41 weeks

Affected

Not disclosed

Linked

15 filings

Confidence

64%

Full breach record for The Washington Post →2 incidents on file

The Washington Post experienced a data security incident due to a previously unknown vulnerability in Oracle E-Business Suite software. Unauthorized access occurred between July 10, 2025, and August 22, 2025. The Post was contacted by a bad actor in October 2025, leading to an investigation. Affected data includes names and other personal information. The Post secured systems, applied patches, and is offering identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 1, 2025 → Notified Jul 10, 2026282d ✗ CA 60-day late41 weeks discovery → filing

Incident timeline

undetected · 83 days

discovery → filing · 41 weeks / 285 days

Jul 10, 2025

Begins

Oct 1, 2025

Discovered

Jul 13, 2026

Filed

This filing is one of 15 about the same incident.View merged incident

Part of ORACLE CORPORATION supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim predates this filing by 247 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Washington State AGbd_63991b5360c381222026-07-13Verified by operator
New Hampshire State AGbd_7696587630ae34ed2026-07-13Verified
Vermont State AGbd_c1d11a5eb36e7ede2026-07-13Verified by operator
Oregon State AGbd_0d97643c7c02e0a62026-07-14 · +1dVerified by operator

Show 6 more filings ↓up to 243d gap

Texas State AGbd_8e858a0885ff65162026-07-14 · +1dVerified by operator
Indiana State AGbd_209d44025d2c2a3d2025-11-12 · +243dVerified
Montana State AGbd_2d05f81698405b0c2025-11-12 · +243dCandidate
Nebraska State AGbd_6e10abe650a92d392025-11-12 · +243dVerified by operator
Massachusetts State AGbd_ae6db829f44ccef92025-11-12 · +243dVerified by operator
New Hampshire State AGbd_b0c26abd0a0c427f2025-11-12 · +243dVerified

Showing first 10 of 14 linked disclosures.

Name: The Washington Post
norm: the washington post
Domain: washingtonpost.com

Name: The Washington Post
norm: the washington post
Domain: washingtonpost.com
Industry: Telecom & Mediallm

Discovered: Oct 1, 2025
Breach occurred: Jul 10, 2025 – Aug 22, 2025
Undetected for: 83 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Third party: via Oracle
Initial access: exploit_public_facing

During the incident: Launched a thorough investigation of our Oracle application environment with the assistance of forensic experts
Promptly secured our systems and Oracle application environment
Applied patches as soon as Oracle made them available
Engaged a third-party expert to conduct a deeper review and analysis of the data
Offering 12 months of complimentary identity protection services from IDX
Changes made: Applied patches as soon as Oracle made them available
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(285 days from discovery to filing)
Compliance flags: CA 60-day late · 282dLeak >180dCA AG copy ≤15d · 3d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 1, 2025
→ Notified: Jul 10, 2026
282d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Jul 10, 2026
→ AG copy submitted: Jul 13, 2026
3d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 1, 2025 → Notified: Jul 10, 2026	282d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Jul 10, 2026 → AG copy submitted: Jul 13, 2026	3d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Indiana State AGNov 12 · first

Montana State AGNov 12 · first

Nebraska State AGNov 12 · first

Massachusetts State AGNov 12 · first

New Hampshire State AGNov 12 · first

Washington State AG+243d

New Hampshire State AG+243d

Vermont State AG+243d

California State AG+243d · this page

Oregon State AG+244d

Texas State AG+244d

Pattern: first filing Nov 12 (IN), last Jul 14 (TX) — a 244-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-626404
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 13, 2026
Raw hash: 498dcf1c8ddd451062a539d65fe20160d077a364850fd67375a4f67b41a7da1f

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Washington Post

Victim entityThe Washington Post

Incidentdiscovered Oct 1, 2025

Stated responseLaunched a thorough investigation of our Oracle application environment with the assistance of forensic experts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov