AccidentalGovernmentGovernmentMisconfigurationEmployee Data InvolvedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

California Department of Business Oversight

bd_89f60541f304e742 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 2, 2015

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for California Department of Business Oversight →

The California Department of Business Oversight (DBO) inadvertently disclosed personal identifying information, including Social Security numbers, of registered investment advisers and broker-dealers in response to Public Records Act requests. The data was exposed in a field labeled 'Docket/Case #' which was not redacted. DBO placed an immediate hold on releasing electronic licensing records and is working with FINRA to prevent further disclosures. Notices were sent on March 23, 2015.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 5, 2015

Begins

Apr 2, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: California Department of Business Oversight
norm: california department of business oversight

Name: California Department of Business Oversight
norm: california department of business oversight
Industry: Governmentllm

Discovered: —
Breach occurred: Jan 5, 2015
Materiality determined: —
Notification sent: Mar 23, 2015
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unknown

During the incident: Placed an immediate hold on providing the public with copies of our electronic licensing records until further notice
Working with FINRA and our own staff to prevent any further inadvertent disclosures of personal identifying information
Changes made: Working with FINRA and our own staff to prevent any further inadvertent disclosures of personal identifying information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-49208
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2015
Raw hash: 64e032068b3e1567eb51c63e68a3eb8cb4e7a9231452e1d4290220b784a3aec7

Reporting entityCalifornia Department of Business Oversight

Victim entityCalifornia Department of Business Oversight

IncidentUnknown

Stated responsePlaced an immediate hold on providing the public with copies of our electronic licensing records until further notice

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov