Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
State Controller's Office
bd_d410929ef5d4c6a3 · schema v1 · pii pii-v1
Full breach record for State Controller's Office →The California State Controller's Office experienced a data breach after an employee clicked a phishing link, granting an unauthorized user access to their email account from March 18-19, 2021. The attacker accessed Unclaimed Property Holder Reports containing names, addresses, SSNs, birth dates, and property values. Access was promptly removed, and 24 months of identity theft resolution services were offered to affected individuals.
California clockDiscovered Mar 19, 2021 → Notified Mar 22, 20212d ✓ CA 60-day OK4 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-539387
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 23, 2021
- Raw hash
- 3f0be04fb477cde430af2468826a06724cf4e30c52b0abd95c23b8ecd0af47fb
Reporting entity
- Name
- State Controller's Officenorm: state controller s office
Victim entity
- Name
- State Controller's Officenorm: state controller s office
Incident
- Discovered
- Mar 19, 2021
- Materiality determined
- —
- Notification sent
- Mar 22, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 4 days(4 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 2d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 19, 2021→ Notified: Mar 22, 20212d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.