AccidentalGovernmentGovernmentMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumResolved

County of Sacramento

bd_c02dfd2cd91f9dab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2016

Filed

Aug 26, 2016

To disclose

25 days

Affected

Not disclosed

Confidence

65%

Full breach record for County of Sacramento →3 incidents on file

County of Sacramento notified residents that an error in the Accela software online application system may have exposed personal data (name, address, SSN, driver's license, phone, DOB) to EMS license applicants. The unauthorized access report was deployed on August 8, 2015, and shut off within an hour of discovery on August 1, 2016. The County corrected the issue with the vendor and offered one year of identity protection.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 1, 2016 → Notified Aug 17, 201616d ✓ CA 60-day OK25 days discovery → filing

Incident timeline

undetected · 359 days

discovery → filing · 25 days

Aug 8, 2015

Begins

Aug 1, 2016

Discovered

Aug 26, 2016

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: County of Sacramento
norm: county of sacramento

Name: County of Sacramento
norm: county of sacramento
Industry: Governmentllm

Discovered: Aug 1, 2016
Breach occurred: Aug 8, 2015 – Aug 1, 2016
Undetected for: 359 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 17, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
Regulator citations: Reporting this data exposure to the California Attorney General’s office

During the incident: Shut off the report providing the data within an hour of discovery
Working with the software vendor and has corrected the problem
Reporting this data exposure to the California Attorney General’s office
Offering a complimentary one-year membership of Experian’s® ProtectMyID® Elite
Changes made: Corrected the problem in the online automated application system within the Accela software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 1, 2016
→ Notified: Aug 17, 2016
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 1, 2016 → Notified: Aug 17, 2016	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-63584
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2016
Raw hash: 9008ec1c5695a6b3150022bb6777328d37369733d4419b7f74c2df7b6122764e

Reporting entityCounty of Sacramento

Victim entityCounty of Sacramento

Incidentdiscovered Aug 1, 2016

Stated responseShut off the report providing the data within an hour of discovery

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov