The California Office of the Attorney General disclosed a data breach affecting Osaic, stemming from a systems intrusion at its third-party vendor, R.R. Donnelley & Sons Company, on December 23, 2021. The incident exposed sensitive personal information, including names, addresses, and Social Security numbers of an undisclosed number of individuals. The breach was reported publicly on August 17, 2023, highlighting a delayed discovery or notification timeline. The compromised data suggests a high-risk scenario where personally identifiable information (PII) was accessed by unauthorized actors, potentially enabling identity theft, financial fraud, or targeted phishing attacks. The involvement of a vendor introduces additional complexity, as the breach originated outside Osaic’s direct control, raising concerns about supply chain security and the adequacy of third-party risk management protocols. The lack of clarity on the number of affected individuals further complicates risk assessment and response efforts.