Social EngineeringProfessional ServicesHealthcareProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsPHIGovernment IDIdentity (basic)Health (basic)Financial accountHighContained

The Affiliated Group

bd_d7bfbdef63373e43 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 28, 2018

Filed

Sep 19, 2018

To disclose

25 weeks

Affected

1,289state residents only

Linked

4 filings

Confidence

66%

Full breach record for The Affiliated Group →

The Affiliated Group (TAG) confirmed on March 28, 2018, that an unauthorized actor gained access to one employee email account following a phishing incident in November 2017. The attacker used the account to send phishing emails. A review determined that names, Social Security numbers, medical record numbers, limited treatment information, subscriber IDs, and some financial account information were potentially accessible. 1,289 California residents were notified starting September 19, 2018. TAG provided 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 28, 2018 → Notified Sep 19, 2018175d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

undetected · 147 days

discovery → filing · 25 weeks / 175 days

Nov 1, 2017

Begins

Mar 28, 2018

Discovered

Sep 19, 2018

Filed

vs. sector median

+7 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_d8c2bc646745bfb92018-09-19Verified
Montana State AGbd_a54d25ade4e6dc582018-09-18 · +1dCandidate
New Hampshire State AGbd_e1d6c24523b7f8412018-09-27 · +8dVerified

Name: The Affiliated Group
norm: the affiliated

Name: The Affiliated Group
norm: the affiliated
Industry: Professional ServicesllmHealthcarellm

Discovered: Mar 28, 2018
Breach occurred: Nov 1, 2017 – Nov 30, 2017
Undetected for: 147 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2018
Affected individuals: 1,289state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified certain regulators as required
Initial access: phishing_link

During the incident: Disabled the compromised employee email account
Reset all account passwords
Worked with third-party forensic investigators to determine what happened
Undertook a programmatic and manual review of the contents of the account
Provided notice to client entities with consumers affected
Provided notice to affected individuals
Provided complimentary access to twelve (12) months of identity theft protection and mitigation services through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Changes made: Taken steps to further increase security awareness to reduce the likelihood of a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: CA 60-day late · 175d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 28, 2018
→ Notified: Sep 19, 2018
175d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 28, 2018 → Notified: Sep 19, 2018	175d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGSep 18 · first

Massachusetts State AG+1d

California State AG+1d · this page

New Hampshire State AG+9d

Pattern: first filing Sep 18 (MT), last Sep 27 (NH) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-139990
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2018
Raw hash: d98ca4434bb7c07e4f16b685577d83cb338d3c4f07eaa2a64e9e6df86a5bab76

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe Affiliated Group

Victim entityThe Affiliated Group

Incidentdiscovered Mar 28, 2018

Stated responseDisabled the compromised employee email account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov