HackingTechnologyInformationCustomer Data InvolvedEmployee Data InvolvedGovernment IDFinancial accountIdentity (basic)MediumResolved

Black Mountain Software

bd_8c97242426e7fb3b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 17, 2014

Filed

Jul 3, 2014

To disclose

16 days

Affected

Not disclosed

Confidence

64%

Full breach record for Black Mountain Software →

Black Mountain Software experienced an online security problem on June 17, 2014, involving unauthorized access to files for eight client organizations (including municipalities and schools) between May 30 and June 13, 2014. Affected data included Social Security numbers, bank account numbers, and other personal information. The company resolved the issue, conducted a forensic review, and offered 12 months of identity protection to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 17, 2014 → Notified Jul 3, 201416d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 18 days

discovery → filing · 16 days

May 30, 2014

Begins

Jun 17, 2014

Discovered

Jul 3, 2014

Filed

vs. sector median

16 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Black Mountain Software
norm: black mountain software
Domain: blackmountainsoftware.com

Name: Black Mountain Software
norm: black mountain software
Domain: blackmountainsoftware.com
Industry: Technologyllm

Discovered: Jun 17, 2014
Breach occurred: May 30, 2014 – Jun 13, 2014
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 3, 2014
Affected individuals: Not disclosed
Data types: Government IDFinancial accountIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Worked to resolve the issue within minutes of the discovery
Alerted all BMS customers of the situation
Conducted a thorough forensic review of records
Notified each of the eight client organizations with accessed files
Arranged to have AllClear ID protect identity for 12 months at no cost
Changes made: Taken steps to prevent a similar occurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 17, 2014
→ Notified: Jul 3, 2014
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 17, 2014 → Notified: Jul 3, 2014	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-45747
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 3, 2014
Raw hash: 8520a48371a2b988136a6e089a4b3a9ca801527ce9f4b397eac5a1e9b78e4b24

Reporting entityBlack Mountain Software

Victim entityBlack Mountain Software

Incidentdiscovered Jun 17, 2014

Stated responseWorked to resolve the issue within minutes of the discovery

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov