MisuseData MishandlingEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumResolved

ABACUS DATA SYSTEMS, INC.

bd_c80602d94b9fccd6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 14, 2021

Filed

Feb 10, 2021

To disclose

27 days

Affected

Not disclosed

Confidence

64%

Full breach record for ABACUS DATA SYSTEMS, INC. →

Abacus Data Systems, Inc. notified the California Attorney General of a data security incident involving a former employee who downloaded and inadvertently emailed a report containing personal information of current and former employees on December 28, 2020. The data included names, addresses, phone numbers, birthdates, social security numbers, and salaries. The company discovered the incident on January 14, 2021, and confirmed the data was not further accessed or shared. Complimentary identity monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 14, 2021 → Notified Feb 8, 202125d ✓ CA 60-day OK27 days discovery → filing

Incident timeline

undetected · 17 days

discovery → filing · 27 days

Dec 28, 2020

Begins

Jan 14, 2021

Discovered

Feb 10, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: ABACUS DATA SYSTEMS, INC.
norm: abacus data

Name: ABACUS DATA SYSTEMS, INC.
norm: abacus data

Discovered: Jan 14, 2021
Breach occurred: Dec 28, 2020
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Insider
Threat actor: Internal
Initial access: insider_action

During the incident: Conducted an investigation
Ensured the Report containing Abacus employees’ personal information was not accessed, opened, downloaded, saved, copied, forwarded or shared
Ensured any instance of the email containing the Report had been deleted from the Former Employee’s email server
Obtained a sworn statement from the Former Employee under penalty of perjury
Implemented additional internal controls and safeguards to prevent a recurrence
Changes made: Implemented additional internal controls and safeguards to prevent a recurrence of this type of data breach
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: CA 60-day OK · 25d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 14, 2021
→ Notified: Feb 8, 2021
25d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 14, 2021 → Notified: Feb 8, 2021	25d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537900
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 10, 2021
Raw hash: 79fe481952f739516254f73f0daea4b711e363fb598074356e0c8f2b4513d328

Reporting entityABACUS DATA SYSTEMS, INC.

Victim entityABACUS DATA SYSTEMS, INC.

Incidentdiscovered Jan 14, 2021

Stated responseConducted an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov