PhysicalGovernmentGovernmentLossCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentHealth (basic)MediumContained

STATE OF CALIFORNIA

bd_bf03be0ec1c23480 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 12, 2012

Filed

Mar 29, 2012

To disclose

17 days

Affected

Not disclosed

Confidence

66%

Full breach record for STATE OF CALIFORNIA →3 incidents on file

The California Department of Child Support Services reported the loss of specialized computer storage devices containing personal information (names, SSNs, driver's licenses, health insurance IDs, employer info) for parents, caregivers, and children. The devices were in transit from IBM's facility in Colorado to California via Iron Mountain Inc. when they went missing on March 12, 2012. The department notified affected individuals, credit bureaus, and regulators, and is working with vendors to recover the devices.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 days

Mar 12, 2012

Begins

Mar 12, 2012

Discovered

Mar 29, 2012

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: STATE OF CALIFORNIA
norm: state of california

Name: STATE OF CALIFORNIA
norm: state of california
Industry: Governmentllm

Discovered: Mar 12, 2012
Breach occurred: Mar 12, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmploymentHealth (basic)
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified the California Attorney General’s OfficeNotified the State Office of Privacy Protection

During the incident: Continuing to work with IBM and Iron Mountain to recover these storage devices
Advised the three major U.S. credit reporting agencies (Experian, Equifax and TransUnion) of this incident
Notified the California Attorney General’s Office
Notified the State Office of Privacy Protection
Changes made: Reviewing the circumstances that caused this incident
Continuing to work with business partners to minimize future risks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-22855
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2012
Raw hash: 64a4d3e63da96f5d07c465d9f46cb308cddddba5dafc3cd86c9243745cd1e566

Reporting entitySTATE OF CALIFORNIA

Victim entitySTATE OF CALIFORNIA

Incidentdiscovered Mar 12, 2012

Stated responseContinuing to work with IBM and Iron Mountain to recover these storage devices

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov