MisuseGovernmentGovernmentPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

California Department of Social Services

bd_c0bcaa1f4bb4192b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 19, 2024

Filed

Oct 3, 2024

To disclose

11 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for California Department of Social Services →5 incidents on file

The California Department of Social Services (CDSS) disclosed that employees of a contractor operating the Sun Bucks call center improperly accessed case information in the ebtEDGE Web Admin platform between June 6 and June 18, 2024. The breach was discovered on July 19, 2024. Affected data included children's names, addresses, dates of birth, EBT card numbers, and account numbers. CDSS terminated the employees' access, compensated for lost benefits, issued new cards, and offered identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 19, 2024 → Notified Sep 27, 202470d ✗ CA 60-day late11 weeks discovery → filing

Incident timeline

undetected · 43 days

discovery → filing · 11 weeks / 76 days

Jun 6, 2024

Begins

Jul 19, 2024

Discovered

Oct 3, 2024

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: California Department of Social Services
norm: california department of social

Name: California Department of Social Services
norm: california department of social
Industry: Governmentllm

Discovered: Jul 19, 2024
Breach occurred: Jun 6, 2024 – Jun 18, 2024
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 27, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: Reported to the California Information Security Office
Third party: via Sun Bucks call center contractor
Initial access: trusted_relationship

During the incident: Terminated access for the identified employees
Reported the incident to the appropriate authorities
Compensated individuals for benefits lost
Issued new cards to affected individuals
Reported the incident and remediation efforts to the California Information Security Office
Changes made: Reviewing and revising procedures and practices to minimize the risk of recurrence
Contractor took proactive steps to minimize the risk of recurrence and to monitor for any additional suspicious activity
Offered free IDX identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: CA 60-day late · 70d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 19, 2024
→ Notified: Sep 27, 2024
70d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 19, 2024 → Notified: Sep 27, 2024	70d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-592849
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2024
Raw hash: a90a9f74cae3f66098dfb7d241c19f2e24fa922058c3730fbbd3e3c4ae0ab449

Reporting entityCalifornia Department of Social Services

Victim entityCalifornia Department of Social Services

Incidentdiscovered Jul 19, 2024

Stated responseTerminated access for the identified employees

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov