HackingSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDHealth (basic)EmploymentHighContained

HUMANGOOD SOCAL

bd_9475c152d1488eb6 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 27, 2017

Filed

Nov 3, 2017

To disclose

5 weeks

Affected

4,844state residents only

Linked

3 filings

Confidence

66%

Full breach record for HUMANGOOD SOCAL →

HumanGood notified the California Attorney General that a third-party benefits coordination vendor may have accessed personal information of 4,844 HumanGood employees residing in California. The incident occurred and was discovered on September 27, 2017. Affected data included names, addresses, email addresses, dates of birth, Social Security numbers, wage information, and medical information. HumanGood notified the FBI and local law enforcement and offered 12 months of credit monitoring and identity protection services through AllClear ID.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 27, 2017 → Notified Oct 17, 201720d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 37 days

Sep 27, 2017

Begins

Sep 27, 2017

Discovered

Nov 3, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_8da28e3733d4da792017-10-30 · +4dCandidate
New Hampshire State AGbd_9225629788cd219b2017-10-30 · +4dVerified

Name: HUMANGOOD SOCAL
norm: humangood socal

Name: HUMANGOOD SOCAL
norm: humangood socal

Discovered: Sep 27, 2017
Breach occurred: Sep 27, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 17, 2017
Affected individuals: 4,844state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Employment
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
Threat actor: External
Regulator citations: Notified the Federal Bureau of InvestigationNotified the Pleasanton Police Department
Third party: via third-party benefits coordination vendor
Initial access: trusted_relationship

During the incident: Notified the service provider
Conducted an investigation of the incident
Notified the Federal Bureau of Investigation
Notified the Pleasanton Police Department
Notified the affected California residents
Offering 12 months of credit monitoring and identity protection services through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: CA 60-day OK · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 27, 2017
→ Notified: Oct 17, 2017
20d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 27, 2017 → Notified: Oct 17, 2017	20d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGOct 30 · first

New Hampshire State AGOct 30 · first

California State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-103240
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2017
Raw hash: aef6eeec4fda1d45daaaf7e7c05a2eb6ccd1bfdb3d46b2b18e61e9e23c8e82d9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHUMANGOOD SOCAL

Victim entityHUMANGOOD SOCAL

Incidentdiscovered Sep 27, 2017

Stated responseNotified the service provider

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov