MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CENTRAL LICENSING BUREAU

bd_becdc0895df7402b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2021

Filed

Jul 8, 2022

To disclose

32 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for CENTRAL LICENSING BUREAU →3 incidents on file

Central Licensing Bureau, Inc. experienced a ransomware attack on November 29, 2021, where an unauthorized third party accessed and disabled computer systems. The incident potentially exposed names, addresses, dates of birth, Social Security numbers, and driver's license numbers. The company engaged forensic investigators, rebuilt systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 29, 2021 → Notified Jul 8, 2022221d ✗ CA 60-day late32 weeks discovery → filing

Incident timeline

discovery → filing · 32 weeks / 221 days

Nov 29, 2021

Begins

Nov 29, 2021

Discovered

Jul 8, 2022

Filed

vs. sector median

+14 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9b8b6fd928e6fd2e2022-07-08Verified

Name: CENTRAL LICENSING BUREAU
norm: central licensing bureau

Name: CENTRAL LICENSING BUREAU
norm: central licensing bureau
Industry: Professional Servicesllm

Discovered: Nov 29, 2021
Breach occurred: Nov 29, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Engaged a third party forensic firm to assist us with securing the network environment and investigating the extent of any unauthorized activity
Wiped and rebuilt affected systems
Taken steps to bolster our network security
Reviewed and altered our policies, procedures, and network security software relating to the security of our systems and servers, as well as how we store and manage data
Changes made: Taken steps to bolster our network security
Reviewed and altered our policies, procedures, and network security software relating to the security of our systems and servers, as well as how we store and manage data
Providing you with access to Single Bureau Credit Monitoring services at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(221 days from discovery to filing)
Compliance flags: CA 60-day late · 221d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 29, 2021
→ Notified: Jul 8, 2022
221d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 29, 2021 → Notified: Jul 8, 2022	221d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJul 8 · first

California State AGJul 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-555083
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2022
Raw hash: 803958cfb95c5591671b84cf7e49e78b38c133c1f7e799b6a4a2d7bd35f6754f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCENTRAL LICENSING BUREAU

Victim entityCENTRAL LICENSING BUREAU

Incidentdiscovered Nov 29, 2021

Stated responseEngaged a third party forensic firm to assist us with securing the network environment and investigating the extent of any unauthorized activity

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov