AccidentalProfessional ServicesProfessional ServicesMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)MinorMediumResolved

George Hills

bd_8d37e383543520fc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 9, 2015

Filed

Dec 8, 2015

To disclose

13 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for George Hills →

George Hills Company, Inc. (GHC) notified California residents of a data breach involving its third-party service provider, Systema Software. On September 9, 2015, Systema Software informed GHC that a security researcher had identified a configuration error in a claims management website application, allowing unauthorized access to a temporary data backup. The breach occurred on September 3, 2015. Affected data included names, Social Security numbers, driver's license numbers, and medical information. Systema Software corrected the permissions and hired a security firm. The researcher self-reported to the Texas AG and provided an affidavit stating no unauthorized use occurred.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 13 weeks / 90 days

Sep 3, 2015

Begins

Sep 9, 2015

Discovered

Dec 8, 2015

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: George Hills
norm: george hills
Domain: georgehills.com

Name: George Hills
norm: george hills
Domain: georgehills.com
Industry: Professional Servicesllm

Discovered: Sep 9, 2015
Breach occurred: Sep 3, 2015
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Minor
Data elements: Social Security numberMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Security researcher contacted the Texas Attorney General and self-reported the issueThe Texas Attorney General investigated the report and obtained an affidavit from the security researcher
Third party: via Systema Software
Initial access: exploit_public_facing

During the incident: Systema Software corrected the permissions for the application and eliminated the issue
Systema Software hired a computer security firm to ensure that the configuration issue was corrected and to determine the extent of the access
GHC conducted an investigation of the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-59212
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 8, 2015
Raw hash: b552e07543efb1cb73f1de8718bff630c93efbc209db643d91c7c21ef6e88265

Reporting entityGeorge Hills

Victim entityGeorge Hills

Incidentdiscovered Sep 9, 2015

Stated responseSystema Software corrected the permissions for the application and eliminated the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov