Full Report
A data breach involving CHP 11-99 Foundation was reported on February 3, 2026. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: BEC Attack Compromises CHP 11-99 Foundation Data
## Executive Summary
The CHP 11-99 Foundation suffered a data breach initiated via a Business Email Compromise (BEC) attack stemming from a successful phishing lure clicked by a staff member. The unauthorized access, which lasted approximately eight days in September 2025, exposed highly sensitive personal data of members and donors. The incident was formally reported on February 3, 2026, and the Foundation is mitigating risk by offering credit monitoring services.
## Incident Details
- Discovery Date: September 24, 2025 (Inferred from end of unauthorized access period)
- Incident Date: September 16, 2025 (Start of unauthorized access)
- Affected Organization: CHP 11-99 Foundation (chp11-99.org)
- Sector: Nonprofit/Support Services (Supporting California Highway Patrol employees)
- Geography: Not explicitly stated, serving California Highway Patrol support.
## Timeline of Events
### Initial Access
- **Date/Time:** September 16, 2025
- **Vector:** Phishing link delivered via email.
- **Details:** A staff member received a suspicious email. After forwarding the email to their external IT service provider for verification, the provider mistakenly approved the link as "clean." The employee then clicked the link, granting the attacker full access to their email account.
### Lateral Movement
- **Details:** Limited details on deep lateral movement, but the attacker achieved full access to **all email folders, including attachments** such as membership applications, merchandise orders, and payment forms, indicating broad access to stored data within the mailbox. The attacker also attempted to leverage this access to launch a secondary phishing attack against the same IT help desk.
### Data Exfiltration/Impact
- **Details:** Data associated with membership applications, merchandise orders, and payment forms was accessible. Exposed data included full names, addresses, **Social Security numbers (SSNs), driver’s license numbers, and bank/credit card information** of affected members and donors.
### Detection & Response
- **Detection:** September 24, 2025 (Unauthorized access ceased).
- **Response Actions:** Forensic investigations were initiated following the detection of secondary phishing attempts. Notification letters were sent to affected individuals in late January/early February 2026. The Foundation is offering 12 months of credit monitoring via Kroll. Plans were indicated to transition to a new IT and security partner due to the service provider's error.
## Attack Methodology
- **Initial Access:** Phishing leading to credential compromise/session takeover.
- **Persistence:** Maintained access through the compromised email account for approximately 8 days.
- **Privilege Escalation:** Not explicitly detailed, assumed immediate access to the mailbox content granted sufficient privilege for data harvesting.
- **Defense Evasion:** Exploited the failure of the third-party IT service provider's verification process.
- **Credential Access:** Direct access to session tokens or credentials implied by full mailbox access.
- **Discovery:** Scanning and reviewing email folders and attachments (membership applications, payment forms).
- **Lateral Movement:** Attempted pivot to target the external IT Service Provider via a secondary phishing campaign launched from the compromised account.
- **Collection:** Gathering documents containing PII, financial data, and identification numbers.
- **Exfiltration:** Not explicitly detailed, but collection of sensitive files implies exfiltration occurred or was intended.
- **Impact:** Identity theft and financial fraud risk for victims due to exposure of SSNs and bank details.
## Impact Assessment
- **Financial:** Unknown costs, but potential liability from the breach and cost of identity monitoring services.
- **Data Breach:** High-sensitivity PII, including **SSNs, driver's license numbers, and financial data (bank/credit card info)**. Volume of records undisclosed.
- **Operational:** No significant long-term operational disruption noted, though forensic investigation and stakeholder notification required resources.
- **Reputational:** Negative impact due to the exposure of sensitive CHP-affiliated participant data.
## Indicators of Compromise
(Note: The source material did not provide specific artifacts like hashes or IP addresses; these are inferred behaviors.)
- **Network Indicators:** Suspicious outbound connections from the compromised mailbox server (if observable). Attempts to initiate secondary phishing campaigns targeting the IT provider.
- **File Indicators:** Documents containing membership data, payment forms, and PII being opened or accessed outside of normal business activity during the access window.
- **Behavioral Indicators:** Uncharacteristic access patterns to email folders and attachments by the compromised user account between September 16–24, 2025.
## Response Actions
- **Containment:** Terminating the attacker’s access (inferred as access ceased on September 24, 2025).
- **Eradication:** Not fully detailed, assumed resetting credentials for the compromised account and potentially all related accounts.
- **Recovery:** Notified affected parties (late Jan/early Feb 2026). Provisioning 12 months of credit monitoring services through Kroll. Initiating transition to a new IT/security partner.
## Lessons Learned
- Reliance on manual, subjective verification processes (like an IT help desk verifying a link via non-specialized methods) creates a critical security gap.
- The failure of a third-party IT provider in security validation directly led to a major data breach.
- Attackers who successfully compromise an email account often leverage that access to attempt further attacks (pivoting to the service provider).
## Recommendations
- Implement multi-factor authentication (MFA) universally across all email accounts, especially for staff handling PII.
- Review and automate the process for validating suspicious links, removing reliance on manual verification by non-security personnel.
- Conduct immediate termination/reset of all credentials associated with the breached mailbox path and conduct a full audit of the IT service provider's security protocols.
- Mandate immediate enrollment in provided credit monitoring services for all affected individuals.