HackingTelecom & MediaInformationStolen CredentialsCustomer Data InvolvedCredentialsIdentity (basic)MediumActive

TengoInternet

bd_064dcaed316bb30e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 23, 2018

Filed

Oct 26, 2018

To disclose

5 weeks

Affected

59,835state residents only

Confidence

66%

Full breach record for TengoInternet →

TengoInternet, Inc. notified the California AG of unauthorized access to a consumer database containing usernames, passwords, names, and email addresses. The incident was discovered on September 23, 2018, with access occurring in or prior to April 2018. Approximately 59,835 California residents were affected. The company engaged forensic investigators, notified the FBI, disabled inactive accounts, and forced password resets. The investigation was ongoing at the time of notification.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 23, 2018 → Notified Oct 26, 201833d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 175 days

discovery → filing · 5 weeks / 33 days

Apr 1, 2018

Begins

Sep 23, 2018

Discovered

Oct 26, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed59,835 affectedView incident

Name: TengoInternet
norm: tengointernet
Domain: tengointernet.com

Name: TengoInternet
norm: tengointernet
Domain: tengointernet.com
Industry: Telecom & Mediallm

Discovered: Sep 23, 2018
Breach occurred: Apr 1, 2018 – Apr 30, 2018
Undetected for: 175 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 26, 2018
Affected individuals: 59,835state-resident count only
Data types: CredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBI

During the incident: Engaged an outside forensic investigator
Notified the FBI of this incident
Disabled inactive accounts
Implemented a procedure to require password changes for all remaining accounts
Providing potentially affected individuals with information on how to protect against identity theft and fraud
Changes made: Review existing information security procedures
Implement additional safeguards to further secure the information on its systems
Continuing to monitor their systems to ensure they are secure
Enhance data security protections to protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: CA 60-day OK · 33d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 23, 2018
→ Notified: Oct 26, 2018
33d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 23, 2018 → Notified: Oct 26, 2018	33d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141167
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2018
Raw hash: 918a3d47565fad9fda3a14a464ae131c27a40e8f85fc8bbcc0030967e540521a

Reporting entityTengoInternet

Victim entityTengoInternet

Incidentdiscovered Sep 23, 2018

Stated responseEngaged an outside forensic investigator

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov