Social EngineeringGovernmentGovernmentPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

State Controller's Office

bd_d410929ef5d4c6a3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

Mar 23, 2021

To disclose

4 days

Affected

Not disclosed

Confidence

65%

Full breach record for State Controller's Office →

The California State Controller's Office experienced a data breach after an employee clicked a phishing link, granting an unauthorized user access to their email account from March 18-19, 2021. The attacker accessed Unclaimed Property Holder Reports containing names, addresses, SSNs, birth dates, and property values. Access was promptly removed, and 24 months of identity theft resolution services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 19, 2021 → Notified Mar 22, 20212d ✓ CA 60-day OK4 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 3 days

Mar 18, 2021

Begins

Mar 19, 2021

Discovered

Mar 23, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: State Controller's Office
norm: state controller s office

Name: State Controller's Office
norm: state controller s office
Industry: Governmentllm

Discovered: Mar 19, 2021
Breach occurred: Mar 18, 2021 – Mar 19, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 22, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: The improperly accessed email account was discovered promptly and access removed
SCO Unclaimed Property Division personnel immediately began a review of all emails in the account for personal identifying information that may have been viewed
Contacts of the SCO employee were advised to delete suspicious emails and not click on any links therein
Arranged to make available 24 months of identity theft resolution services provided by Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 days(4 days from discovery to filing)
Compliance flags: CA 60-day OK · 2d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 19, 2021
→ Notified: Mar 22, 2021
2d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 19, 2021 → Notified: Mar 22, 2021	2d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539387
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2021
Raw hash: 3f0be04fb477cde430af2468826a06724cf4e30c52b0abd95c23b8ecd0af47fb

Reporting entityState Controller's Office

Victim entityState Controller's Office

Incidentdiscovered Mar 19, 2021

Stated responseThe improperly accessed email account was discovered promptly and access removed

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov