Cyber Incident Victim: Orange County Employees Association
Date:
Jun 2015
Location:
United States of America
Summary
The Orange County Employees Association suffered a cyberattack potentially compromising personal and dependent information of members, non-members, staff, health trust participants, affiliated customers, and their families. Exposed data included names, addresses, Social Security numbers, driver’s licenses, payroll details, health enrollment records, retirement statuses, login credentials, and dependents’ information. The organization promptly engaged federal law enforcement for forensic analysis upon detecting the breach. Affected individuals received notifications and were offered complimentary credit monitoring alongside identity theft restoration services for one year. The association established a dedicated support line and published an informational resource to address concerns related to the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Orange County Employees Association (OCEA) in Santa Ana, California, discovered a cybersecurity incident on July 23, 2015, involving unauthorized access to personal information. Forensic analysis indicated the breach may have occurred as early as June 5, 2015, though the exact intrusion method remained unspecified in public disclosures. The compromise potentially affected multiple groups: OCEA members, non-members, participants in the OCEA Health & Welfare Trust, OCEA staff, customers of Velece Corporation, and dependents of these individuals. Exposed data types included names, addresses, dates of birth, Social Security numbers, driver's license numbers, payroll information, dental/vision/life/disability enrollment details, retirement statuses, usernames and passwords, and dependents' information. OCEA did not disclose the total number of affected individuals but confirmed the breach impacted both current and former associates across multiple affiliated entities.
Within hours of detection, OCEA contacted the U.S. Secret Service, which deployed personnel to OCEA's offices to collect and analyze server data. On July 31, 2015, the organization initiated notifications via email and physical mail to affected individuals for whom they held current contact information. OCEA offered impacted parties one year of credit monitoring, identity theft restoration services, and identity theft insurance through a third-party provider. The association established a dedicated call line and published an FAQ section on its member website (oceamember.org/cybersecurity) to address inquiries. No ransomware demands or explicit attacker motives were disclosed in available reports, and OCEA did not specify whether systems were fully restored or permanently taken offline following the investigation. The incident highlighted risks to employee associations managing sensitive beneficiary data across multiple stakeholder groups.