HackingStolen CredentialsEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Department of Toxic Substances Control
bd_b1660651a7b77e27 · schema v1 · pii pii-v1
Full breach record for Department of Toxic Substances Control →On March 10, 2023, the California Department of Toxic Substances Control (DTSC) discovered a compromised email account. An external threat actor briefly gained unauthorized access to the account. While no files were downloaded, the attacker may have viewed emails containing employees' names, Social Security Numbers, Driver's License Numbers, and medical information. DTSC immediately cut off access to the mailbox and limited inbox access to appropriate staff. The incident is contained.
California clockDiscovered Mar 10, 2023 → Notified Mar 20, 202310d ✓ CA 60-day OK13 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-564680
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 23, 2023
- Raw hash
- 66bdeec1372e7b6274c5327f0abeb356ab9d0aed87f0391ab577ddab511c0857
Reporting entity
- Name
- Department of Toxic Substances Controlnorm: department of toxic substances control
- Domain
- dtsc.ca.gov
Victim entity
- Name
- Department of Toxic Substances Controlnorm: department of toxic substances control
- Domain
- dtsc.ca.gov
Incident
- Discovered
- Mar 10, 2023
- Materiality determined
- —
- Notification sent
- Mar 20, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 13 days(13 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 10d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 10, 2023→ Notified: Mar 20, 202310d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.