HackingCustomer Data InvolvedIdentity (basic)LowContained

Sunrise

bd_a48a8f1361370e5d · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 28, 2026

To disclose

—

Affected

Not disclosed

Linked

6 records

Confidence

65%

Full breach record for Sunrise →

Sunrise Company notified the California Attorney General of an incident where an unauthorized actor gained access to its network on April 23, 2026, acquiring certain files. The investigation concluded that names and other unspecified information were involved. The company contained the event, secured its network, and is offering 24 months of credit monitoring to affected individuals. No evidence of identity theft or fraud was found.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Apr 23, 2026

Begins

Jul 28, 2026

Filed

This filing is one of 6 records about the same incident.View merged incident

A leak claim by akira about this victim was first seen 63 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_b5f9edc8f94d1b142026-06-03 · +55dVerified by operator
Leak Siteakirabd_35cba7e2ad8282712026-05-26 · +63dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_0a7a936e21f624b62026-07-28Candidate
Massachusetts State AGbd_0768f47f9fb82ada2026-07-29 · +1dVerified
Texas State AGbd_337a568f99e217972026-07-31 · +3dVerified

Name: Sunrise-Sunset.org
norm: sunrise sunsetorg
Domain: sunrise-sunset.org

Name: Sunrise
norm: sunrise
Domain: sunrise.ch

Discovered: —
Breach occurred: Apr 23, 2026
Materiality determined: —
Notification sent: Jul 28, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying state and federal regulators, as required

During the incident: Immediately took steps to contain the event
Launched an investigation to determine the nature and scope of the activity
Undertook a thorough review of the potentially impacted data
Assessed and secured our network
Notifying state and federal regulators, as required
Offering twenty-four (24) months of complimentary access to credit monitoring and identity restoration services
Changes made: Reviewing our policies, procedures, and employee training to further protect against similar events occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJul 28 · first

California State AGJul 28 · first · this page

Massachusetts State AG+1d

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-627296
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2026
Raw hash: b3fdd088895a9be9c0587f95cfb3bdf2c714c6650acd42e76e05cc1f2464d3d6

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entitySunrise-Sunset.org

Victim entitySunrise

IncidentUnauthorized Access

Stated responseImmediately took steps to contain the event

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov