PhysicalEducationEducationTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)HighContained

CALIFORNIA COLLEGE OF THE ARTS

bd_7d2950008d19fdc7 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 19, 2018

Filed

Feb 26, 2018

To disclose

5 weeks

Affected

2,581state residents only

Linked

2 filings

Confidence

66%

Full breach record for CALIFORNIA COLLEGE OF THE ARTS →

On January 19, 2018, a laptop used by an employee of California College of the Arts was stolen from the employee's vehicle. The device may have contained names, Social Security numbers, dates of birth, subscriber member numbers, and health insurance information for up to 2,581 California residents. The College changed passwords, monitored for device activity, and engaged third-party cybersecurity firms. No evidence of misuse was found. Notices were sent on February 26, 2018, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 19, 2018 → Notified Feb 26, 201838d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 38 days

Jan 19, 2018

Begins

Jan 19, 2018

Discovered

Feb 26, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_55a0e400180368762018-02-26Verified

Name: CALIFORNIA COLLEGE OF THE ARTS
norm: california college of the arts

Name: CALIFORNIA COLLEGE OF THE ARTS
norm: california college of the arts
Industry: Educationllm

Discovered: Jan 19, 2018
Breach occurred: Jan 19, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2018
Affected individuals: 2,581state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Provided notice of this incident to state regulators as requiredProvided notice of this incident to the U.S. Department of Health and Human Services

During the incident: Reported the theft to College staff and to local law enforcement
Changed the user’s passwords to prevent access to the College’s computer systems
Monitored for signs that the laptop was active to remotely wipe the device
Consulted with third party firms that focus on cybersecurity issues to assist in the investigation
Cooperated with law enforcement’s investigation
Provided written notice to individuals whose data may have been present on the laptop
Offered complimentary access to one (1) year of credit and identity monitoring services, including identity restoration services, through AllClear ID
Established a dedicated call center for potentially affected individuals
Changes made: Provided potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: CA 60-day OK · 38d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 19, 2018
→ Notified: Feb 26, 2018
38d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 19, 2018 → Notified: Feb 26, 2018	38d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRFeb 26 · first

California State AGFeb 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134073
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2018
Raw hash: 68ab27c4e50b3e27c6663ec84b2849e43bdc3c649edb00e508eee8aeba26023f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCALIFORNIA COLLEGE OF THE ARTS

Victim entityCALIFORNIA COLLEGE OF THE ARTS

Incidentdiscovered Jan 19, 2018

Stated responseReported the theft to College staff and to local law enforcement

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov