Social EngineeringPhishingEmployee Data InvolvedIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTIDENTITY_BASICMediumContained
Mercy Housing, Inc., Mercy Housing Management Group, Inc.
bd_a91578aaa599c389 · schema v1 · pii pii-v1
Full breach record for Mercy Housing, Inc., Mercy Housing Management Group, Inc. →Mercy Housing experienced a security breach involving the unauthorized release of 2015 W-2 forms for current and former employees due to an email scam. The incident occurred on February 19, 2016. Affected data included Social Security numbers, names, and financial information. The company engaged LifeLock for credit monitoring and SupportLinc for identity theft assistance, and notified law enforcement.
California clockDiscovered Feb 19, 2016 → Notified Feb 20, 20161d ✓ CA 60-day OK6 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-60215
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 25, 2016
- Raw hash
- 1f45a32ad056da3cae62fba33f04849bacedff606a0c60dc42acccc431f5494f
Reporting entity
- Name
- Mercy Housing, Inc., Mercy Housing Management Group, Inc.norm: mercy housing inc mercy housing management
Victim entity
- Name
- Mercy Housing, Inc., Mercy Housing Management Group, Inc.norm: mercy housing inc mercy housing management
Incident
- Discovered
- Feb 19, 2016
- Materiality determined
- —
- Notification sent
- Feb 20, 2016
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTFINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566 Phishing
- Threat actor
- ExternalFinancial
- Regulator citations
- Informed law enforcement and Federal agencies of this incident
- Initial access
- phishing_link
Compliance
- Time to disclose
- 6 days(6 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 1d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 19, 2016→ Notified: Feb 20, 20161d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.