Social EngineeringGovernmentGovernmentPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

County Of Orange

bd_fbb4a4e177064195 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 31, 2023

Filed

Sep 12, 2025

To disclose

32 months

Affected

Not disclosed

Confidence

66%

Full breach record for County Of Orange →

The County of Orange Office of Care Coordination experienced a data breach after an employee's email account was compromised via a suspected phishing attack on January 31, 2023. The incident potentially exposed names, addresses, dates of birth, and Social Security numbers. The County secured the account, reset credentials, implemented MFA, and engaged a forensic firm. Affected individuals are offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 months / 955 days

Jan 31, 2023

Begins

Jan 31, 2023

Discovered

Sep 12, 2025

Filed

vs. sector median

+126 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: County Of Orange
norm: county of orange

Name: County Of Orange
norm: county of orange
Industry: Governmentllm

Discovered: Jan 31, 2023
Breach occurred: Jan 31, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Filed notification with California Attorney General
Initial access: phishing_link

During the incident: Secured the affected account
Reset credentials
Implemented additional security measures to prevent further unauthorized access
Engaged a third-party data forensics firm to assist with the analysis
Initiated an MFA (multi-factor authentication) reset
Tightened security controls to prevent a similar intrusion
Retained E piq to provide 24 months of credit monitoring and identity protection through Equifax Credit Watch Gold
Changes made: Initiated an MFA (multi-factor authentication) reset
Tightened security controls to prevent a similar intrusion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 months(955 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-609898
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2025
Raw hash: 0b719f589706663f26e77127c21e5aa59a2ae447b79917c90c25658b4f7f60dc

Reporting entityCounty Of Orange

Victim entityCounty Of Orange

Incidentdiscovered Jan 31, 2023

Stated responseSecured the affected account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov