HackingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHIFinancial accountPIIMediumContained

Windsor Cheviot Hills, LLC

bd_8993377c2d64d768 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 23, 2024

To disclose

—

Affected

Not disclosed

Confidence

77%

Full breach record for Windsor Cheviot Hills, LLC →

Windsor Cheviot Hills, LLC notified affected individuals of a data security incident involving a managed services provider that hosted servers storing company data. On September 13, 2023, the provider determined a security incident occurred involving potential unauthorized access to data including names, addresses, health/medical information, SSNs, driver's license numbers, credit card and bank account numbers. Twelve months of credit monitoring was offered via Transunion/Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 13, 2023

Begins

Feb 23, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Windsor Cheviot Hills, LLC
norm: windsor cheviot hills

Name: Windsor Cheviot Hills, LLC
norm: windsor cheviot hills

Discovered: —
Breach occurred: Sep 13, 2023 – Sep 14, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PHIFinancial accountPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Making regulatory notifications to the extent requiredFiled notice with California Office of the Attorney General

During the incident: Took immediate steps to attempt to determine the nature and scope of the incident
Making regulatory notifications to the extent required
Offering complimentary access to twelve (12) months of credit monitoring services through Transunion (via Cyberscout/IdentityForce)
Changes made: Offering credit monitoring services through Transunion (via Cyberscout/IdentityForce, a TransUnion company)
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-581462
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2024
Raw hash: d71b8500e5dde1f9505c37fed1cafe0dcf47a4e73dcc0c88575bf8c96d9cdf3a

Reporting entityWindsor Cheviot Hills, LLC

Victim entityWindsor Cheviot Hills, LLC

IncidentThird-Party / Supply Chain

Stated responseTook immediate steps to attempt to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov