Social EngineeringTechnologyManufacturingInformationPhishingStolen CredentialsData ExfiltratedRansom DemandedCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)Government IDFinancial accountMediumContained

ULTRA CLEAN HOLDINGS, INC.

bd_c786788ea3638551 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 5, 2020

Filed

Dec 23, 2020

To disclose

20 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for ULTRA CLEAN HOLDINGS, INC. →2 incidents on file

Ultra Clean Holdings, Inc. (UCT) experienced a phishing attack on August 3-4, 2020, discovered on August 5, 2020. An external actor used phishing to gain access and exfiltrate personal information, including names, addresses, and potentially financial data. The attackers demanded ransom to prevent data release. UCT contained the incident within 35 hours and is offering two years of credit monitoring via Experian to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 5, 2020 → Notified Oct 23, 202079d ✗ CA 60-day late20 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 20 weeks / 140 days

Aug 3, 2020

Begins

Aug 5, 2020

Discovered

Dec 23, 2020

Filed

vs. sector median

+2 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_e5a5b45aee7556d32020-12-21 · +2dVerified
Maine State AGbd_5db3f2dc02d3ea4d2020-12-17 · +6dVerified
Oregon State AGbd_10838ceb3c5347372020-11-10 · +43dVerified
Indiana State AGbd_03edadda5870d6cf2020-11-09 · +44dVerified

Show 2 more filings ↓up to 61d gap

Maine State AGbd_9f16c0167e7bd3582020-10-23 · +61dCandidate
Montana State AGbd_e8e9dcedfef9c1c52020-10-23 · +61dVerified

Name: ULTRA CLEAN HOLDINGS, INC.
norm: ultra clean
Domain: uct.com

Name: ULTRA CLEAN HOLDINGS, INC.
norm: ultra clean
Domain: uct.com
Industry: TechnologyllmManufacturingllm

Discovered: Aug 5, 2020
Breach occurred: Aug 3, 2020 – Aug 4, 2020
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2020
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notification with California Attorney General
Initial access: phishing_link

During the incident: Detected intrusion within 35 hours
Providing complimentary two-year subscription to Experian IdentityWorks
Providing identity theft detection and resolution services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(140 days from discovery to filing)
Compliance flags: CA 60-day late · 79d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 5, 2020
→ Notified: Oct 23, 2020
79d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 5, 2020 → Notified: Oct 23, 2020	79d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Maine State AGOct 23 · first

Montana State AGOct 23 · first

Indiana State AG+17d

Oregon State AG+18d

Maine State AG+55d

New Hampshire State AG+59d

California State AG+61d · this page

Pattern: first filing Oct 23 (ME), last Dec 23 (CA) — a 61-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-197489
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2020
Raw hash: 68d80ade6f6e57b9293c374fa1d60db78414b35c91d81a2093ba1b1db4851eab

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityULTRA CLEAN HOLDINGS, INC.

Victim entityULTRA CLEAN HOLDINGS, INC.

Incidentdiscovered Aug 5, 2020

Stated responseDetected intrusion within 35 hours

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov