AccidentalManufacturingManufacturingMisconfigurationData MishandlingEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDEmploymentMediumContained

JOHNSON MATTHEY INC.

bd_ef4ba323d8345d19 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 15, 2024

Filed

Mar 18, 2024

To disclose

5 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for JOHNSON MATTHEY INC. →

Johnson Matthey, Inc. disclosed that a contractor inadvertently left employment records containing names, SSNs, and dates of birth on a third-party storage platform without access controls since 2020. The company discovered the issue on February 15, 2024, removed the files, and found no evidence of unauthorized access. Identity protection services were offered to affected U.S. employees.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 15, 2024 → Notified Mar 18, 202432d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 1506 days

discovery → filing · 5 weeks / 32 days

Jan 1, 2020

Begins

Feb 15, 2024

Discovered

Mar 18, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_73f54870d5e3d0a42024-03-18Verified
Maine State AGbd_801c5971392610012024-03-18Candidate
New Hampshire State AGbd_85e79c0d9204dbf72024-03-18Verified
Indiana State AGbd_a14ba91227c9f7e02024-03-18Verified

Name: JOHNSON MATTHEY INC.
norm: johnson matthey

Name: JOHNSON MATTHEY INC.
norm: johnson matthey
Industry: Manufacturingllm

Discovered: Feb 15, 2024
Breach occurred: Jan 1, 2020 – Feb 15, 2024
Undetected for: 1,506 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 18, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain

During the incident: Located the files
Removed them from the storage platform
Performed an investigation into the incident
Performed searches of external websites and repositories
Offering two years of identity protection services through Experian
Changes made: Assessed steps to prevent a recurrence
Review of third-party data handling protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: CA 60-day OK · 32d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 15, 2024
→ Notified: Mar 18, 2024
32d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 15, 2024 → Notified: Mar 18, 2024	32d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMar 18 · first

Maine State AGMar 18 · first

New Hampshire State AGMar 18 · first

Indiana State AGMar 18 · first

California State AGMar 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-582607
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2024
Raw hash: 0ff21259a832ab35bfb7fb1b22becb25f5e90e49e9a97b27b953043e25f6c27a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJOHNSON MATTHEY INC.

Victim entityJOHNSON MATTHEY INC.

Incidentdiscovered Feb 15, 2024

Stated responseLocated the files

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov