MalwareRansomwareData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

HCI Group

bd_a6478b03672ad0ba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 2, 2020

Filed

Sep 13, 2021

To disclose

13 months

Affected

Not disclosed

Confidence

64%

Full breach record for HCI Group →2 incidents on file

HCI, LLC experienced a malware attack on September 2, 2020, where an unauthorized person accessed and acquired files containing personal information of current and former employees. The company hired forensic investigators, notified the FBI, and enhanced network security. Affected individuals were offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 2, 2020 → Notified Jun 8, 2021279d ✗ CA 60-day late13 months discovery → filing

Incident timeline

discovery → filing · 13 months / 376 days

Sep 2, 2020

Begins

Sep 2, 2020

Discovered

Sep 13, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: HCI Group
norm: hci group
Domain: hcigroup.com

Name: HCI Group
norm: hci group
Domain: hcigroup.com

Discovered: Sep 2, 2020
Breach occurred: Sep 2, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 8, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation of the incident

During the incident: Conducted an investigation
Hired independent computer forensic investigators
Hired a third party vendor to conduct a thorough review of the impacted information
Notified the Federal Bureau of Investigation of the incident
Took steps to enhance the security of our network
Offering free identity monitoring and recovery services for 12 months through IDX
Changes made: Took steps to enhance the security of our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(376 days from discovery to filing)
Compliance flags: CA 60-day late · 279d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 2, 2020
→ Notified: Jun 8, 2021
279d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 2, 2020 → Notified: Jun 8, 2021	279d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-545233
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 13, 2021
Raw hash: ab961e4ec89f2ff4d95a588cfe634a838f6627352aab341fd3ebee3ee176b05b

Reporting entityHCI Group

Victim entityHCI Group

Incidentdiscovered Sep 2, 2020

Stated responseConducted an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov