HackingGovernmentGovernmentCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

California Department of Corrections and Rehabilitation

bd_97fde22c616799e5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 1, 2022

Filed

Aug 22, 2022

To disclose

33 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for California Department of Corrections and Rehabilitation →8 incidents on file

California Department of Corrections and Rehabilitation (CDCR) notified individuals of unauthorized access to a file-sharing platform. Suspicious activity was discovered in January 2022, dating back to December 2021. An investigation confirmed an unauthorized user accessed the system, but no evidence of data copying or downloading was found. Affected data included names, addresses, phone numbers, emails, dates of birth, and medical information (COVID-19 testing, mental health, substance use treatment). No SSNs or financial data were involved. CDCR shut down the platform and migrated to a new system with enhanced security.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 1, 2022 → Notified Aug 19, 2022230d ✗ CA 60-day late33 weeks discovery → filing

Incident timeline

undetected · 11 days

discovery → filing · 33 weeks / 233 days

Dec 21, 2021

Begins

Jan 1, 2022

Discovered

Aug 22, 2022

Filed

vs. sector median

+22 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_9563e209b3098d612022-08-22Verified

Name: California Department of Corrections and Rehabilitation
norm: california department of corrections and rehabilitation

Name: California Department of Corrections and Rehabilitation
norm: california department of corrections and rehabilitation
Industry: Governmentllm

Discovered: Jan 1, 2022
Breach occurred: Dec 21, 2021
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 19, 2022
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Immediately shut down that file-sharing platform
Launched an extensive, multi-agency law enforcement investigation
Reviewed and revised our procedures and practices to minimize the risk of recurrence
Utilizing a new system with greater security controls and protocols
Changes made: Reviewed and revised our procedures and practices to minimize the risk of recurrence
Utilizing a new system with greater security controls and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(233 days from discovery to filing)
Compliance flags: CA 60-day late · 230d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 1, 2022
→ Notified: Aug 19, 2022
230d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 1, 2022 → Notified: Aug 19, 2022	230d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRAug 22 · first

California State AGAug 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-556463
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2022
Raw hash: a80decdd0bfa420290f50be530ee31e1be4da20088642e7d17082935251f9458

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCalifornia Department of Corrections and Rehabilitation

Victim entityCalifornia Department of Corrections and Rehabilitation

Incidentdiscovered Jan 1, 2022

Stated responseImmediately shut down that file-sharing platform

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov