HackingTechnologyInformationStolen CredentialsBrute ForceData ExfiltratedCustomer Data InvolvedDelayed DiscoveryCredentialsIdentity (basic)LowContained

Imgur

bd_00752b9c7d105e20 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 23, 2017

Filed

Nov 24, 2017

To disclose

≤1 day

Affected

Not disclosed

Confidence

64%

Full breach record for Imgur →

Imgur disclosed a 2014 data breach in November 2017. An unauthorized third party stole user account data, including email addresses and passwords. Passwords were encrypted with SHA-256, which may have been cracked via brute force. Imgur forced password resets and updated its hashing algorithm to Bcrypt. No PII such as names or addresses was involved.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 23, 2017 → Notified Nov 23, 20170d ✓ CA 60-day OK≤1 day discovery → filing

Incident timeline

undetected · 1422 days

discovery → filing · ≤1 day / 1 days

Jan 1, 2014

Begins

Nov 23, 2017

Discovered

Nov 24, 2017

Filed

vs. sector median

19 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Imgur
norm: imgur

Name: Imgur
norm: imgur
Industry: Technologyllm

Discovered: Nov 23, 2017
Breach occurred: Jan 1, 2014 – Dec 31, 2014
Undetected for: 1,422 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 23, 2017
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1110 Brute Force
Threat actor: External

During the incident: Immediately requiring all potentially affected users to update their password
Logged out of your account on Imgur and you will need to reset your password to sign back in
Conducting an internal security review of our system and processes
Changes made: Updated our algorithm to the newer Bcrypt algorithm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: CA 60-day OK · 0d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 23, 2017
→ Notified: Nov 23, 2017
0d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 23, 2017 → Notified: Nov 23, 2017	0d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-113864
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 24, 2017
Raw hash: 448299351a2aeec3cd19c0de3b09518e7c94c536d5534345e32bab8e44fcaa58

Reporting entityImgur

Victim entityImgur

Incidentdiscovered Nov 23, 2017

Stated responseImmediately requiring all potentially affected users to update their password

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov