Social EngineeringTechnologyInformationPhishingEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

PIVOTAL SOFTWARE, INC.

bd_f27735e9912788ef · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2016

Filed

Mar 30, 2016

To disclose

8 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for PIVOTAL SOFTWARE, INC. →

Pivotal Software, Inc. experienced a phishing incident on March 22, 2016, where an unknown third party sent a fraudulent email impersonating CEO Rob Mee to an employee. The employee responded, providing personal information including 2015 Form W-2s, which contained names, addresses, income information, and Social Security Numbers. Pivotal investigated, notified law enforcement and the IRS, and offered 3 years of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 22, 2016 → Notified Mar 31, 20169d ✓ CA 60-day OK8 days discovery → filing

Incident timeline

discovery → filing · 8 days

Mar 22, 2016

Begins

Mar 22, 2016

Discovered

Mar 30, 2016

Filed

vs. sector median

18 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_0fbf9611d039da3d2016-03-30Verified
Massachusetts State AGbd_409d4842e28549f02016-04-01 · +2dVerified

Name: PIVOTAL SOFTWARE, INC.
norm: pivotal software

Name: PIVOTAL SOFTWARE, INC.
norm: pivotal software
Industry: Technologyllm

Discovered: Mar 22, 2016
Breach occurred: Mar 22, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified law enforcementContacted the IRS
Initial access: phishing_link

During the incident: Immediately took steps to investigate the incident
Attempted to track down where the information may have gone
Attempted to prevent further access to the information
Notified law enforcement
Contacted the IRS
Changes made: Arranged for AllClear ID to protect identity for 3 years at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: CA 60-day OK · 9d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 22, 2016
→ Notified: Mar 31, 2016
9d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 22, 2016 → Notified: Mar 31, 2016	9d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 30 · first

California State AGMar 30 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-60798
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2016
Raw hash: 63b23adce581f36a7d43754924ce9aa7cc971c5476fa65307ba9e0b766752719

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPIVOTAL SOFTWARE, INC.

Victim entityPIVOTAL SOFTWARE, INC.

Incidentdiscovered Mar 22, 2016

Stated responseImmediately took steps to investigate the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov