HackingCustomer Data InvolvedIdentity (basic)LowContained

The Burton Corporation

bd_ce1bd7de7cff6fe2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 11, 2023

Filed

Feb 6, 2024

To disclose

51 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for The Burton Corporation →3 incidents on file

The Burton Corporation reported a supplemental data breach notification to the California Attorney General. On February 11, 2023, suspicious activity was discovered impacting system operability. An investigation determined that an unknown actor potentially accessed or took files containing personal information, including names and other identity data. The company reset passwords, engaged forensic specialists, notified regulators and law enforcement, and offered identity theft protection services to affected individuals. The filing is classified as supplemental.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 11, 2023 → Notified Feb 5, 2024359d ✗ CA 60-day late51 weeks discovery → filing

Incident timeline

discovery → filing · 51 weeks / 360 days

Feb 11, 2023

Begins

Feb 11, 2023

Discovered

Feb 6, 2024

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_2ef5adbcecd95b9c2024-02-06Candidate
Oregon State AGbd_aa5f698272349f242024-02-06Verified by operator
New Hampshire State AGbd_dfcebd5c646e55852024-02-06Verified
Vermont State AGbd_79151f2b273a2ac42024-02-05 · +1dVerified

Name: The Burton Corporation
norm: the burton

Name: The Burton Corporation
norm: the burton

Discovered: Feb 11, 2023
Breach occurred: Feb 11, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified relevant state regulators

During the incident: Launched an investigation working with industry-leading computer forensics specialists
Reset relevant account passwords
Reviewed the contents of the impacted systems to determine whether they contained personal information
Reviewed internal systems to identify contact information for purposes of providing notice
Notified potentially affected individuals
Notified relevant state regulators
Reported this incident to law enforcement
Offering complimentary access to Experian’s IdentityWorks for identity theft detection and resolution services
Changes made: Reviewing existing policies and procedures to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 51 weeks(360 days from discovery to filing)
Compliance flags: CA 60-day late · 359d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 11, 2023
→ Notified: Feb 5, 2024
359d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 11, 2023 → Notified: Feb 5, 2024	359d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGFeb 5 · first

Maine State AG+1d

Oregon State AG+1d

New Hampshire State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-580610
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2024
Raw hash: 6198a6619b4e723267a3769ba1f45345e8a8c39a40cb007f6b0e0fead91f912a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Burton Corporation

Victim entityThe Burton Corporation

Incidentdiscovered Feb 11, 2023

Stated responseLaunched an investigation working with industry-leading computer forensics specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov