HackingProfessional ServicesProfessional ServicesStolen CredentialsEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Drug Free Workplaces

bd_7c980389ee4fad0a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 27, 2023

To disclose

—

Affected

Linked

6 filings

Confidence

67%

Full breach record for Drug Free Workplaces →

Drug Free Workplaces USA, LLC reported that an unauthorized individual accessed two employee email accounts between March 29, 2023, and May 4, 2023. The compromised accounts contained full names and Social Security numbers of approximately four Rhode Island residents. The company engaged outside cybersecurity professionals to investigate and is offering one year of complimentary identity theft protection services through IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 29, 2023

Begins

Oct 27, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_102259a7fe4b427f2023-10-27Verified
Maine State AGbd_27a05a4bca8616ec2023-10-27Verified by operator
Montana State AGbd_0b61ca403f5b92722023-10-26 · +1dCandidate
Vermont State AGbd_4a8f74a43edb3b0d2023-10-26 · +1dVerified

Show 1 more filing ↓up to 6d gap

New Hampshire State AGbd_5070856c93dfda082023-11-02 · +6dVerified

Name: Drug Free Workplaces
norm: drug free workplaces
Domain: drugfreeworkplaces.com

Name: Drug Free Workplaces
norm: drug free workplaces
Domain: drugfreeworkplaces.com
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Mar 29, 2023 – May 4, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 4nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Analyzed the extent of any compromise of the email accounts and the security of the emails and attachments contained within them
Offering a complimentary one-year membership in identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 26 · first

Vermont State AGOct 26 · first

Indiana State AG+1d

Maine State AG+1d

California State AG+1d · this page

New Hampshire State AG+7d

Pattern: first filing Oct 26 (MT), last Nov 2 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-575794
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 27, 2023
Raw hash: f0c13f23976cc7f30940dd22c348cb9bbee6cb4eb7094d8da576de4d47cfbe51

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDrug Free Workplaces

Victim entityDrug Free Workplaces

IncidentUnauthorized Access

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov