HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

The Office of the Los Angeles City Attorney

bd_c8832a79a5c80c30 · schema v1 · pii pii-v2

Severity

Low

Discovered

Mar 20, 2026

Filed

Sep 18, 2026

To disclose

26 weeks

Affected

Not disclosed

Confidence

68%

Full breach record for The Office of the Los Angeles City Attorney →

The Office of the Los Angeles City Attorney experienced a data breach involving a file-sharing platform used for civil litigation discovery. An unauthorized actor used compromised credentials to access data between December 28, 2025, and January 22, 2026. The Office became aware of the incident on March 20, 2026. Personal information, including names and potentially other identifiers, was exposed. The Office secured the system, engaged a third-party reviewer, and is providing 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 82 days

discovery → filing · 26 weeks / 182 days

Dec 28, 2025

Begins

Mar 20, 2026

Discovered

Sep 18, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: The Office of the Los Angeles City Attorney
norm: the office of the los angeles city attorney

Name: The Office of the Los Angeles City Attorney
norm: the office of the los angeles city attorney
Industry: Governmentllm

Discovered: Mar 20, 2026
Breach occurred: Dec 28, 2025 – Jan 22, 2026
Undetected for: 82 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation
Secured the file share
Engaged an independent third party to complete a thorough review of the data
Secured the services of Kroll to provide identity monitoring at no cost for 12 months
Changes made: Taken steps to enhance existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(182 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629957
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2026
Raw hash: c109a176557d14e93c343e14722e9a41f2406768badf3f0d775aef7f535173c5

Reporting entityThe Office of the Los Angeles City Attorney

Victim entityThe Office of the Los Angeles City Attorney

Incidentdiscovered Mar 20, 2026

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov