MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

The Donovan Company

bd_fc100d320111873f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 20, 2022

Filed

Feb 14, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for The Donovan Company →

The Donovan Company, CPA detected and stopped a sophisticated ransomware attack on December 20, 2022. An unauthorized third party accessed and disabled computer systems, encrypting files. Personal information including name, address, and SSN may have been accessed. Systems were restored from backups. The company engaged IT support, law enforcement (Irvine PD, FBI), and security experts. Affected individuals are offered 24 months of credit monitoring and fraud assistance via Cyberscout.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 56 days

Dec 20, 2022

Discovered

Feb 14, 2023

Filed

vs. sector median

10 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_3a979de517812ad92022-12-22 · +54dVerified by operator

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1d6cf7b5ad6a1d7f2023-02-14Verified

Name: The Donovan Company
norm: the donovan
Domain: thedonovancompany.com

Name: The Donovan Company
norm: the donovan
Domain: thedonovancompany.com
Industry: Professional Servicesllm

Discovered: Dec 20, 2022
Materiality determined: —
Notification sent: Feb 16, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Consulted with law enforcement including Irvine PD and the Orange County Cyber Security Program which works closely with the FBI

During the incident: Shut down access to our network
Engaged our IT support to help us investigate, evaluate, and respond to the situation
Consulted with law enforcement including Irvine PD and the Orange County Cyber Security Program which works closely with the FBI
Engaged appropriate experts to assist us in conducting a full review of our security practices and systems
Offering services provided by Cyberscout, a company specializing in fraud assistance and remediation services
Providing access to Triple Bureau Credit Monitoring/Triple Bureau Credit Report/Triple Bureau Credit Score services at no charge for twenty-four months
Changes made: Made additional enhancements to our systems, security and practices
Rebuilt all our systems and restored everything from our backups
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: Leak >30dCA 60-day OK · 58d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 20, 2022
→ Notified: Feb 16, 2023
58d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 20, 2022 → Notified: Feb 16, 2023	58d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-563172
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2023
Raw hash: eb03b894c5d108ef91fe294ca208e62d1d44cb2f7df62ac15039bf9fb30abc15

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Donovan Company

Victim entityThe Donovan Company

Incidentdiscovered Dec 20, 2022

Stated responseShut down access to our network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov