California State AG
Clustered 6 filings across 5 jurisdictions · filing window Oct 13, 2025 → Dec 10, 2025. View entity profile → Other incidents for this victim →
incident inc_2ecafc73f16b434f · merge_method deterministic · confidence 100%
Discovered → first regulatory filing
Range of discovered_at dates across filings
CA IN ME NH VT
Time between earliest and latest filing
Not recorded for this incident
Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster.
all State AG
per-filing reported counts
State AGs report only their own residents; bars show per-filing counts.
Earliest sighting first · deep chronology in Litigation Timeline
Jul 9, 2025
When the intrusion reportedly occurred, per the linked filings
Jul 9, 2025
Reported by CALIFORNIA AG, VERMONT AG, NEW HAMPSHIRE AG filings
Oct 7, 2025
Reported by MAINE AG filing
Workers' Compensation Insurance Rating Bureau of California (WCIRB) notified individuals that an unauthorized third party accessed their Box.com system on or about July 9, 2025. The incident involved the acquisition of personal information, including names. WCIRB engaged forensic specialists and is offering identity theft protection services. The breach was contained, and no evidence of misuse was found.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.
Workers Compensation Insurance Rating Bureau of California detected unauthorized access to its third-party system, Box.com, on July 9, 2025. An unauthorized third party acquired personal information, including names. Forensic investigation concluded on September 18, 2025. The organization engaged forensic specialists, secured the environment, and is offering identity theft protection services.
Workers' Compensation Insurance Rating Bureau of CA reported a data breach to the Indiana Attorney General. The breach occurred on 2025-07-09 and was reported on 2025-10-27. 1 Indiana residents were affected. 2,766 individuals affected in total.
Affected (this filing): 2,766
Workers’ Compensation Insurance Rating Bureau of CA experienced an external system breach (hacking) on July 9, 2025, which was discovered on October 7, 2025. The breach affected one Maine resident who was notified on October 27, 2025. The organization offered 12 months of credit monitoring and identity theft recovery services.
Affected (this filing): 1
Workers’ Compensation Insurance Rating Bureau of California notified consumers of a data breach involving its third-party cloud storage provider, Box.com. An unauthorized third party accessed the system between July 9, 2025, and September 18, 2025, potentially obtaining names. The company engaged forensic investigators, secured the environment, and offered identity theft protection services to affected individuals.
Workers Compensation Insurance Rating Bureau of California notified NH AG of a July 9, 2025 incident where an unauthorized entity accessed its Box.com account. One NH resident's personal info (name) was acquired. WCIRB engaged forensic specialists, secured the environment, and offered 12 months of credit monitoring. No evidence of misuse found.
Affected (this filing): 1