Social EngineeringGovernmentHealthcareGovernmentPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Health (basic)LowContained

Sacramento County Department of Child, Family & Adult Services

bd_da40ea8ba8a75f29 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 22, 2021

Filed

Jan 25, 2022

To disclose

31 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Sacramento County Department of Child, Family & Adult Services →

On June 22, 2021, Sacramento County Department of Child, Family & Adult Services experienced a phishing attack where an unknown threat actor obtained employee credentials to access webmail. Exposed data included names, dates of birth, and medical health information (PHI). No SSNs or financial data were involved. The county reported the incident to law enforcement and DHS, implemented technical safeguards, and offered 12 months of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 31 weeks / 217 days

Jun 22, 2021

Begins

Jun 22, 2021

Discovered

Jan 25, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Sacramento County Department of Child, Family & Adult Services
norm: sacramento county department of child family adult
Domain: saccounty.net

Name: Sacramento County Department of Child, Family & Adult Services
norm: sacramento county department of child family adult
Domain: saccounty.net
Industry: GovernmentllmHealthcarellm

Discovered: Jun 22, 2021
Breach occurred: Jun 22, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reported to the Sacramento Sheriff (Case #21-211501)Reported to Department of Homeland Security (Case#2021-USCERTv3142X8)
Initial access: phishing_link

During the incident: Reported to the Sacramento Sheriff
Reported to Department of Homeland Security
Implemented technical safeguards to prevent further access to any PHI
Offering a complimentary 12-month membership of Experian’s IdentityWorks
Changes made: Reviewing and revising policies and procedure
Security Awareness training to minimize the risk of recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(217 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-550329
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 25, 2022
Raw hash: 7db0d3599a1e0512fdce83d45d385b4ae12cb9fdd6b0e1270bb10f174376466a

Reporting entitySacramento County Department of Child, Family & Adult Services

Victim entitySacramento County Department of Child, Family & Adult Services

Incidentdiscovered Jun 22, 2021

Stated responseReported to the Sacramento Sheriff

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov