HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)LowContained

Workers' Compensation Insurance Rating Bureau of California

bd_aa3c86a48d1f4368 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 9, 2025

Filed

Feb 21, 2026

To disclose

32 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for Workers' Compensation Insurance Rating Bureau of California →

Workers' Compensation Insurance Rating Bureau of California (WCIRB) notified individuals that an unauthorized third party accessed their Box.com system on or about July 9, 2025. The incident involved the acquisition of personal information, including names and potentially other data elements. WCIRB engaged forensic specialists and is offering identity theft protection services. The breach date listed on the CA OAG form is October 9, 2025.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 9, 2025 → Notified Feb 20, 2026226d ✗ CA 60-day late32 weeks discovery → filing

Incident timeline

Oct 9, 2025

Begins

Feb 21, 2026

Filed

vs. sector median

+24 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_1c5afd8ba3a6c1482025-12-10 · +73dVerified
Indiana State AGbd_137c95f7177196c32025-10-27 · +117dVerified
Massachusetts State AGbd_35b6d39f25bdf4942025-10-27 · +117dVerified
Maine State AGbd_499f1565cccef01a2025-10-27 · +117dCandidate

Show 4 more filings ↓up to 131d gap

Vermont State AGbd_c89bebb7fc860ae62025-10-27 · +117dVerified
New Hampshire State AGbd_cec940e56ca4e1c42025-10-27 · +117dVerified
Nebraska State AGbd_f902bf746cb1d0c62025-10-27 · +117dVerified
California State AGbd_5f2e5ff2174ab56b2025-10-13 · +131dVerified

Name: Workers' Compensation Insurance Rating Bureau of California
norm: workers compensation insurance rating bureau of california

Name: Workers' Compensation Insurance Rating Bureau of California
norm: workers compensation insurance rating bureau of california
Industry: Financial Servicesllm

Discovered: Jul 9, 2025
Breach occurred: Oct 9, 2025
Materiality determined: —
Notification sent: Feb 20, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Box.com
Initial access: supply_chain

During the incident: Engaged third-party forensic specialists to confirm the security of our Box.com environment and investigate the extent of any unauthorized activity
Offering identity theft protection services through IDX
Changes made: Taken steps to bolster our security
Reviewing and altering our policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(227 days from discovery to filing)
Compliance flags: CA 60-day late · 226dCA AG copy ≤15d · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 9, 2025
→ Notified: Feb 20, 2026
226d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Feb 20, 2026
→ AG copy submitted: Feb 21, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 9, 2025 → Notified: Feb 20, 2026	226d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Feb 20, 2026 → AG copy submitted: Feb 21, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

California State AGOct 13 · first

Indiana State AG+14d

Massachusetts State AG+14d

Maine State AG+14d

Vermont State AG+14d

New Hampshire State AG+14d

Nebraska State AG+14d

California State AG+58d

California State AG+131d · this page

Pattern: first filing Oct 13 (CA), last Feb 21 (CA) — a 131-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-619136
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2026
Raw hash: 439240f3515e6023cee1ea7971ef8c6a13826d421e1ddb318b47b39e51aca5c3

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityWorkers' Compensation Insurance Rating Bureau of California

Victim entityWorkers' Compensation Insurance Rating Bureau of California

Incidentdiscovered Jul 9, 2025

Stated responseEngaged third-party forensic specialists to confirm the security of our Box.com environment and investigate the extent of any unauthorized activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov