HackingEducationEducationStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)PIILowContained

PUC National

bd_b3c1ed6ad8c11ffa · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 26, 2021

Filed

Nov 17, 2021

To disclose

42 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for PUC National →

PUC National notified the California Attorney General of a data breach discovered on January 26, 2021. An unauthorized actor downloaded information from PUC email accounts. Affected data includes names and other personal information. PUC engaged forensic investigators, secured accounts, and offered 12 months of identity protection via Equifax.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 26, 2021 → Notified Sep 10, 2021227d ✗ CA 60-day late42 weeks discovery → filing

Incident timeline

discovery → filing · 42 weeks / 295 days

Jan 26, 2021

Begins

Jan 26, 2021

Discovered

Nov 17, 2021

Filed

vs. sector median

+34 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: PUC National
norm: puc national

Name: PUC National
norm: puc national
Industry: Educationllm

Discovered: Jan 26, 2021
Breach occurred: Jan 26, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 10, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email Collection
Threat actor: External

During the incident: Worked with third party forensic investigators to investigate the nature and scope of the activity
Secured the compromised accounts
Conducted a deliberate and thorough assessment of the information contained within the accounts
Arranged to have Equifax protect your identity for 12 months at no cost
Changes made: Taken additional steps to improve security and better protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(295 days from discovery to filing)
Compliance flags: CA 60-day late · 227d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 26, 2021
→ Notified: Sep 10, 2021
227d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 26, 2021 → Notified: Sep 10, 2021	227d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-547680
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2021
Raw hash: 4b29066200a6c500e5be9a9f32f5413f6374a649494cf5a4c1d1dbf53b8d9fc5

Reporting entityPUC National

Victim entityPUC National

Incidentdiscovered Jan 26, 2021

Stated responseWorked with third party forensic investigators to investigate the nature and scope of the activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov