HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)LowContained

OC International, Inc

bd_aa071ed47f3aade2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 6, 2023

Filed

Aug 25, 2023

To disclose

29 weeks

Affected

8state residents only

Linked

3 filings

Confidence

64%

Full breach record for OC International, Inc →

OC International, Inc. dba One Challenge notified individuals of unauthorized access to employee email accounts between Jan 24 and Feb 6, 2023. Suspicious activity was discovered on Feb 6, 2023. The incident involved access to emails containing names and other personal data. The company offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 29 weeks / 200 days

Jan 24, 2023

Begins

Feb 6, 2023

Discovered

Aug 25, 2023

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_5d600570066ba7db2023-08-25Verified
Massachusetts State AGbd_b0bb6893798076db2023-08-25Verified

Name: OC International, Inc
norm: oc international

Name: OC International, Inc
norm: oc international
Also named: OC International, Inc.dba oflegal entity
One Challengedba oftrade name
Industry: Technologyllm

Discovered: Feb 6, 2023
Breach occurred: Jan 24, 2023 – Feb 6, 2023
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 25, 2023
Affected individuals: 8state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Immediately launched an investigation
Undertook a comprehensive review of the contents of the accessed email accounts
Implemented additional safeguards
Review our policies and procedures relating to data privacy and security
Providing you with access to credit monitoring and identity protection services through Experian
Changes made: Implemented additional safeguards
Review our policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 25 · first

Massachusetts State AGAug 25 · first

Montana State AGAug 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-605.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2023
Raw hash: 132d1721cda06ebb05176b0acf77d04c59b78224eb3e58659bf826dc4d608392

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOC International, Inc

Victim entityOC International, Inc

Incidentdiscovered Feb 6, 2023

Stated responseImmediately launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov