Social EngineeringProfessional ServicesProfessional ServicesPhishingEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumActive

BrightView

bd_ceb382c54b02a495 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2016

Filed

Feb 10, 2016

To disclose

6 days

Affected

Not disclosed

Confidence

64%

Full breach record for BrightView →

BrightView disclosed that on February 3, 2016, an employee responded to a phishing email by sending a document containing personal information of legacy Brickman team members to an unauthorized party. The data included names, SSNs, dates of birth, addresses, and employment details. BrightView became aware of the incident on February 4, 2016, and notified affected individuals on February 5, 2016. The company engaged Kroll for identity monitoring and is reviewing security controls and providing phishing training.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 4, 2016 → Notified Feb 5, 20161d ✓ CA 60-day OK6 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 6 days

Feb 3, 2016

Begins

Feb 4, 2016

Discovered

Feb 10, 2016

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BrightView
norm: brightview

Name: BrightView
norm: brightview
Industry: Professional Servicesllm

Discovered: Feb 4, 2016
Breach occurred: Feb 3, 2016
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Arranged for Kroll to provide identity monitoring services (including credit monitoring) at no cost for one year
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Reviewing our data security controls
Will take measures to enhance our controls as necessary
Provide our team members with enhanced training regarding phishing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: CA 60-day OK · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 4, 2016
→ Notified: Feb 5, 2016
1d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 4, 2016 → Notified: Feb 5, 2016	1d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-60028
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 10, 2016
Raw hash: cff015c02e4a7e493e02a1fd995b0dc2d675e8faebfa69a900a77442d1f7f242

Reporting entityBrightView

Victim entityBrightView

Incidentdiscovered Feb 4, 2016

Stated responseArranged for Kroll to provide identity monitoring services (including credit monitoring) at no cost for one year

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov