HackingData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
HEXPOL COMPOUNDING AMERICAS
bd_e01025a0ef29947c · schema v1 · pii pii-v1
Full breach record for HEXPOL COMPOUNDING AMERICAS →HEXPOL Compounding Americas detected unauthorized access to its network on December 22, 2024. An investigation revealed that copies of files containing personal information, including Social Security numbers, were exfiltrated by an unauthorized actor. The company contained the network and engaged cybersecurity professionals. Affected individuals are offered 24 months of complimentary credit monitoring through Experian.
California clockDiscovered Dec 22, 2024 → Notified Jul 3, 2025193d ✗ CA 60-day late28 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-605003
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 3, 2025
- Raw hash
- 1c03d181fa66107124193d3b93c8d7dd15f7f698cc2691efde62d6482ea410d8
Reporting entity
- Name
- HEXPOL Holding Inc.norm: hexpol holding
Victim entity
- Name
- HEXPOL COMPOUNDING AMERICASnorm: hexpol compounding americas
- Domain
- hexpol.com
Incident
- Discovered
- Dec 22, 2024
- Materiality determined
- —
- Notification sent
- Jul 3, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 28 weeks(193 days from discovery to filing)
- Compliance flags
- CA 60-day late · 193dLeak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 22, 2024→ Notified: Jul 3, 2025193d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.