HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Cerenade
bd_f651b3836ecd1303 · schema v1 · pii pii-v1
Full breach record for Cerenade →Jewish Family and Community Services- East Bay notified clients of a privacy incident involving their vendor, Cerenade, an electronic database system used for immigration legal records. Unauthorized access occurred on October 2, 2025, and the organization was notified on October 9, 2025. Affected data includes names, dates of birth, and passport or social security numbers. The organization met with the vendor, reviewed processes, and is offering one year of credit monitoring.
California clockDiscovered Oct 9, 2025 → Notified Dec 4, 202556d ✓ CA 60-day OK9 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-615566
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 10, 2025
- Raw hash
- d0f1dba7eb4e5e78effb5f88fbefd226735adab3b47065e84a02243ce1024449
Reporting entity
- Name
- Jewish Family and Community Services- East Baynorm: jewish family and community services east bay
Victim entity
- Name
- Cerenadenorm: cerenade
Incident
- Discovered
- Oct 9, 2025
- Materiality determined
- —
- Notification sent
- Dec 4, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- Threat actor
- External
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 9 weeks(62 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 56d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 9, 2025→ Notified: Dec 4, 202556d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.