HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancialMediumContained

TaxSlayer

bd_9f2d4f3a097040a1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 13, 2016

Filed

Jan 29, 2016

To disclose

16 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for TaxSlayer →

TaxSlayer disclosed that an unauthorized third party accessed customer accounts between October 10, 2015, and December 21, 2015, using credentials obtained from another online service. The breach was discovered on January 13, 2016. Affected data included names, addresses, Social Security numbers, and tax return information. TaxSlayer disabled affected accounts, enforced multi-factor authentication, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 13, 2016 → Notified Jan 27, 201614d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 95 days

discovery → filing · 16 days

Oct 10, 2015

Begins

Jan 13, 2016

Discovered

Jan 29, 2016

Filed

vs. sector median

16 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_40ae479f097ab3a42016-01-29Candidate
Massachusetts State AGbd_b2c2b9a9308ffc582016-02-02 · +4dVerified

Name: TaxSlayer
norm: taxslayer

Name: TaxSlayer
norm: taxslayer
Industry: TechnologyllmFinancial Servicesllm

Discovered: Jan 13, 2016
Breach occurred: Oct 10, 2015 – Dec 21, 2015
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 27, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Filed breach notification with California Attorney General
Initial access: valid_credentials

During the incident: Temporarily disabled access to affected accounts
Required password reset via forgot password utility
Required authentication via multi-factor authentication
Offered free credit monitoring and restoration services through ID Experts
Notified affected individuals
Changes made: Implemented multi-factor authentication requirement for account access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 14d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 13, 2016
→ Notified: Jan 27, 2016
14d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 13, 2016 → Notified: Jan 27, 2016	14d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJan 29 · first

California State AGJan 29 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-59859
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2016
Raw hash: edf0e0aec43299e4e54cb8fe8f315c08c3bbfef96dd857432900268c03f2bb8e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTaxSlayer

Victim entityTaxSlayer

Incidentdiscovered Jan 13, 2016

Stated responseTemporarily disabled access to affected accounts

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov