HackingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Osiac (formerly Advisor Group)
bd_8570007ed50111a0 · schema v1 · pii pii-v1
Full breach record for Osiac (formerly Advisor Group) →Osiac notified California residents of a data breach involving a third-party vendor, R.R. Donnelley & Sons Company (RRD). RRD identified a systems intrusion on December 23, 2021, and notified Osiac on January 17, 2023. Personal information, including name, address, and potentially Social Security numbers, was exfiltrated from RRD's systems. The data originated from a 2019 regulatory mailing. Osiac is offering free identity theft protection services through Experian.
California clockDiscovered Jan 17, 2023 → Notified Aug 9, 2023204d ✗ CA 60-day late30 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-572025
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 17, 2023
- Raw hash
- 04ca1fdf2b48269d49d69c00ebcd14f252930aed6de13f08cddfe65cb69dee04
Reporting entity
- Name
- Osiac (formerly Advisor Group)norm: osiac formerly advisor
- Domain
- osaic.com
Victim entity
- Name
- Osiac (formerly Advisor Group)norm: osiac formerly advisor
- Domain
- osaic.com
Incident
- Discovered
- Jan 17, 2023
- Materiality determined
- —
- Notification sent
- Aug 9, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via R.R. Donnelley & Sons Company
- Initial access
- supply_chain
Compliance
- Time to disclose
- 30 weeks(212 days from discovery to filing)
- Compliance flags
- CA 60-day late · 204d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 17, 2023→ Notified: Aug 9, 2023204d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.