HackingMisconfigurationCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
George Hills
bd_8d37e383543520fc · schema v1 · pii pii-v1
Full breach record for George Hills →George Hills Company, Inc. (GHC) notified California residents of a data breach involving claims database backups hosted by third-party vendor Systema Software. A security researcher identified a misconfiguration allowing unauthorized access to temporary backups containing names, SSNs, driver's license numbers, and medical information. The researcher downloaded data to an external hard drive and surrendered it to the Texas Attorney General. GHC engaged a security firm to remediate the configuration issue.
California clockDiscovered Sep 9, 2015 → Notified Sep 9, 20150d ✓ CA 60-day OK13 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-59212
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 8, 2015
- Raw hash
- b552e07543efb1cb73f1de8718bff630c93efbc209db643d91c7c21ef6e88265
Reporting entity
- Name
- George Hillsnorm: george hills
- Domain
- georgehills.com
Victim entity
- Name
- George Hillsnorm: george hills
- Domain
- georgehills.com
Incident
- Discovered
- Sep 9, 2015
- Materiality determined
- —
- Notification sent
- Sep 9, 2015
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1074 Data Staged
- Threat actor
- External
- Regulator citations
- Security researcher self-reported the issue to the Texas Attorney General
- Third party
- via Systema Software
Compliance
- Time to disclose
- 13 weeks(90 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 9, 2015→ Notified: Sep 9, 20150d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.