UnknownTechnologyProfessional ServicesInformationCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)EmploymentLowContained

Quatrro Business Support Services, Inc.

bd_babb49f6339a98ac · schema v1 · pii pii-v2

Severity

Low

Discovered

Dec 7, 2025

Filed

Sep 9, 2026

To disclose

39 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

70%

Full breach record for Quatrro Business Support Services, Inc. →2 incidents on file

Quatrro Business Support Services, Inc. experienced unauthorized access to certain files between November 11 and November 19, 2025. The company identified the incident on December 7, 2025. The affected files contained information relating to clients' employees and vendors, including basic identity and employment data. Quatrro notified affected clients on August 20, 2026, and is offering 12 months of complimentary identity monitoring through Kroll. The specific attack vector and threat actor remain unknown.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 7, 2025 → Notified Aug 20, 2026256d ✗ CA 60-day late39 weeks discovery → filing

Incident timeline

undetected · 26 days

discovery → filing · 39 weeks / 276 days

Nov 11, 2025

Begins

Dec 7, 2025

Discovered

Sep 9, 2026

Filed

vs. sector median

+21 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_046d408e4d7958cf2026-09-09Verified
Oregon State AGbd_b7332845c87554b82026-09-09Verified
Vermont State AGbd_dfeaa72bcad50f962026-09-09Candidate

Name: Quatrro Business Support Services, Inc.
norm: quatrro business support

Name: Quatrro Business Support Services, Inc.
norm: quatrro business support
Industry: TechnologyllmProfessional Servicesllm

Discovered: Dec 7, 2025
Breach occurred: Nov 11, 2025 – Nov 19, 2025
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Employment
Attack vector: Unknown
Regulator citations: Filed breach notification with California Attorney General

During the incident: Identified and began taking measures to address a security incident
Conducted a thorough investigation
Reviewed files to determine if they contained individual information
Identified clients whose employees’ and vendors’ information was involved
Notified clients on August 20, 2026
Secured the services of Kroll to provide identity monitoring at no cost for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(276 days from discovery to filing)
Compliance flags: CA 60-day late · 256dCA AG copy >15d · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 7, 2025
→ Notified: Aug 20, 2026
256d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Aug 20, 2026
→ AG copy submitted: Sep 9, 2026
20d 15 calendar days CA AG copy >15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 7, 2025 → Notified: Aug 20, 2026	256d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Aug 20, 2026 → AG copy submitted: Sep 9, 2026	20d	15 calendar days	CA AG copy >15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGSep 9 · first

Oregon State AGSep 9 · first

Vermont State AGSep 9 · first

California State AGSep 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629483
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 9, 2026
Raw hash: a27d6074e48daeb661e1702fbd9b5392f88e05327c0ace3405391a4626553147

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityQuatrro Business Support Services, Inc.

Victim entityQuatrro Business Support Services, Inc.

Incidentdiscovered Dec 7, 2025

Stated responseIdentified and began taking measures to address a security incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov