AccidentalProfessional ServicesProfessional ServicesMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

LASOC - Legal Aid Society of Orange County

bd_ed05bdd2920e101d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 31, 2016

Filed

Jan 6, 2017

To disclose

10 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for LASOC - Legal Aid Society of Orange County →

Legal Aid Society of Orange County (LASOC) disclosed that completed tax forms from 2007 and 2008, containing names and Social Security numbers, became temporarily accessible to the public via internet search engines due to a misconfiguration of the I-CAN! web application. LASOC discovered the issue on October 31, 2016, and immediately disabled the application and engaged a forensic firm. The incident affected individuals in California and Rhode Island. LASOC offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 10 weeks / 67 days

Sep 25, 2016

Begins

Oct 31, 2016

Discovered

Jan 6, 2017

Filed

vs. sector median

9 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_b7aab08ea413135f2017-01-06Candidate
Massachusetts State AGbd_b8fd2367b15a62722017-01-06Verified

Name: LASOC - Legal Aid Society of Orange County
norm: lasoc legal aid society of orange county

Name: LASOC - Legal Aid Society of Orange County
norm: lasoc legal aid society of orange county
Industry: Professional Servicesllm

Discovered: Oct 31, 2016
Breach occurred: Sep 25, 2016
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 6, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
Regulator citations: Contacted the IRS as well as other appropriate governmental agencies

During the incident: Immediately took steps to investigate and mitigate the impact of this incident, with the assistance of a third-party forensic investigation firm
Disabled the I-CAN! application
Taken steps to direct the removal of the tax forms from search results on certain internet search engines
Contacted the IRS as well as other appropriate governmental agencies
Providing notice of this incident to you, along with information on how to better protect against identity theft and fraud
Offering you access to 12 months of free credit monitoring and identity restoration services with Experian ProtectMyID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJan 6 · first

Massachusetts State AGJan 6 · first

California State AGJan 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-65740
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2017
Raw hash: 799f848189ac2cd65d4d459de3719ab6174ac50c3ad5a075310913ea2e8d7bb2

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLASOC - Legal Aid Society of Orange County

Victim entityLASOC - Legal Aid Society of Orange County

Incidentdiscovered Oct 31, 2016

Stated responseImmediately took steps to investigate and mitigate the impact of this incident, with the assistance of a third-party forensic investigation firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov