AccidentalFinancial ServicesTechnologyFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDCriticalResolved

First Data Corporation

bd_7b7315e0b954f650 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Apr 25, 2012

Filed

May 11, 2012

To disclose

16 days

Affected · nationwide

108,50015,399 in this filing

Linked

2 filings

Confidence

66%

Full breach record for First Data Corporation →

First Data Corporation disclosed an administrative oversight where limited personal information (name, address, SSN) of approximately 108,500 merchants was shared with three third-party firms for testing verification and anti-fraud services in Jan-Feb 2012. First Data learned of the potential ambiguity in contract authorization on April 25, 2012. The data was deleted by the recipients at First Data's request. 15,399 California residents were affected.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 25, 2012 → Notified May 7, 201212d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 115 days

discovery → filing · 16 days

Jan 1, 2012

Begins

Apr 25, 2012

Discovered

May 11, 2012

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ec28e2b6640162bd2012-05-10 · +1dVerified

Name: First Data Corporation
norm: first data

Name: First Data Corporation
norm: first data
Industry: Financial ServicesllmTechnologyllm

Discovered: Apr 25, 2012
Breach occurred: Jan 1, 2012 – Feb 29, 2012
Undetected for: 115 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 7, 2012
Affected individuals: 108,500state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unknown
Regulator citations: Notified California State Attorney General's Office

During the incident: Requested the three firms delete the data sent from First Data
Providing written notification to the merchants
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 12d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 25, 2012
→ Notified: May 7, 2012
12d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 25, 2012 → Notified: May 7, 2012	12d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 10 · first

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-23158
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2012
Raw hash: 6231c4591caf67980390c1bb6f2f1a085e6feaaa8bcc4283495faafb97d8d435

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFirst Data Corporation

Victim entityFirst Data Corporation

Incidentdiscovered Apr 25, 2012

Stated responseRequested the three firms delete the data sent from First Data

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov