HackingCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
WebTPA Employer Services, LLC
bd_a68e128650f68b0c · schema v1 · pii pii-v1
Full breach record for WebTPA Employer Services, LLC →WebTPA Employer Services, LLC detected suspicious activity on its network on December 28, 2023. An investigation revealed that an unauthorized actor may have accessed personal information between April 18 and April 23, 2023. The incident affected individuals whose data was held by WebTPA in its role providing administrative services to benefit plans and insurance companies. WebTPA engaged third-party cybersecurity experts, notified law enforcement, and is offering two years of identity monitoring services to affected individuals.
California clockDiscovered Dec 28, 2023 → Notified May 8, 2024132d ✗ CA 60-day late29 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_d527d5ff7e9f89a1New Hampshire State AGfiled 2024-07-22(3d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-589007
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 19, 2024
- Raw hash
- b2dcc0c9a97d65956063ad52baaaa18bfed857a57d56a22231bbd7437bc38c5b
Reporting entity
- Name
- WebTPA Employer Services, LLCnorm: webtpa employer
Victim entity
- Name
- WebTPA Employer Services, LLCnorm: webtpa employer
Incident
- Discovered
- Dec 28, 2023
- Materiality determined
- —
- Notification sent
- May 8, 2024
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified federal law enforcement
Compliance
- Time to disclose
- 29 weeks(204 days from discovery to filing)
- Compliance flags
- CA 60-day late · 132d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 28, 2023→ Notified: May 8, 2024132d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.