MalwareRansomwareData EncryptedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
The Donovan Company
bd_fc100d320111873f · schema v1 · pii pii-v1
Full breach record for The Donovan Company →The Donovan Company, CPA detected and stopped a sophisticated ransomware attack on December 20, 2022. An unauthorized third party accessed and disabled computer systems, encrypting files. Personal information including name, address, and SSN may have been accessed. Systems were restored from backups. The company engaged IT support, law enforcement (Irvine PD, FBI), and security experts. Affected individuals are offered 24 months of credit monitoring and fraud assistance via Cyberscout.
Leak gap clock⏱ Leak >30d8 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-563172
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 14, 2023
- Raw hash
- eb03b894c5d108ef91fe294ca208e62d1d44cb2f7df62ac15039bf9fb30abc15
Reporting entity
- Name
- The Donovan Companynorm: the donovan
- Domain
- thedonovancompany.com
Victim entity
- Name
- The Donovan Companynorm: the donovan
- Domain
- thedonovancompany.com
Incident
- Discovered
- Dec 20, 2022
- Materiality determined
- —
- Notification sent
- Feb 16, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- Consulted with law enforcement including Irvine PD and the Orange County Cyber Security Program which works closely with the FBI
Compliance
- Time to disclose
- 8 weeks(56 days from discovery to filing)
- Compliance flags
- Leak >30dCA 60-day OK · 58d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 20, 2022→ Notified: Feb 16, 202358d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.