HackingHealthcareProfessional ServicesHealthcareCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Los Angeles Gay and Lesbian Community Services Center

bd_ae6e826d7413b311 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 22, 2013

Filed

Dec 10, 2013

To disclose

18 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

The L.A. Gay & Lesbian Center experienced a criminal cyber attack between September 17, 2013, and November 8, 2013. The attack potentially exposed names, contact info, medical/healthcare info, dates of birth, credit card info, Social Security numbers, and health insurance account numbers. The intrusion was detected on November 22, 2013. The organization engaged forensic investigators, notified law enforcement, and offered one year of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 22, 2013 → Notified Dec 10, 201318d ✓ CA 60-day OK18 days discovery → filing

Incident timeline

undetected · 66 days

discovery → filing · 18 days

Sep 17, 2013

Begins

Nov 22, 2013

Discovered

Dec 10, 2013

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_a626b557bed8b07b2013-12-10Verified

Name: Los Angeles Gay and Lesbian Community Services Center
norm: los angeles gay and lesbian community services center

Name: Los Angeles Gay and Lesbian Community Services Center
norm: los angeles gay and lesbian community services center
Industry: HealthcarellmProfessional Servicesllm

Discovered: Nov 22, 2013
Breach occurred: Sep 17, 2013 – Nov 8, 2013
Undetected for: 66 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 10, 2013
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement

During the incident: Curtailed the intrusion
Hired numerous experts, including two leading national forensic investigation firms, to help us investigate the situation and determine the individuals and information potentially affected
Began the process of notifying potentially affected individuals
Notified law enforcement
Engaged Experian to provide a dedicated call center to answer questions about this incident
Changes made: Offering one year of complimentary credit monitoring through Experian ProtectMyID Alert
Taking steps to further guard against this type of criminal attack in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: CA 60-day OK · 18d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 22, 2013
→ Notified: Dec 10, 2013
18d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 22, 2013 → Notified: Dec 10, 2013	18d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRDec 10 · first

California State AGDec 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-43465
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 10, 2013
Raw hash: 5e3f7f5d4daf669ca57648425e7ce8c85747e72dbfc18e937fc7131873b54bc4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLos Angeles Gay and Lesbian Community Services Center

Victim entityLos Angeles Gay and Lesbian Community Services Center

Incidentdiscovered Nov 22, 2013

Stated responseCurtailed the intrusion

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov