AccidentalEducationTechnologyEducationMisconfigurationCustomer Data InvolvedIdentity (basic)CredentialsLowContained

The MindFuel Foundation

bd_31cce346b0f71202 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 5, 2025

Filed

Jun 23, 2025

To disclose

7 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for The MindFuel Foundation →

The Mindfuel Foundation disclosed that a snapshot of a historical testing database, potentially containing limited production data (names, emails, phone numbers, usernames, hashed passwords) from before May 2021, was placed in a location accessible to developers by a third-party service provider and may have been viewed by web crawlers on May 5, 2025. The organization removed the data, reset affected passwords, and implemented new secure file transfer and legacy account removal processes.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 49 days

May 5, 2025

Begins

May 5, 2025

Discovered

Jun 23, 2025

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_629fd0e890867ccb2025-06-23Verified
Indiana State AGbd_7a2696397ac674942025-06-20 · +3dVerified
Texas State AGbd_5dd397a7edb530da2025-06-30 · +7dVerified

Name: The MindFuel Foundation
norm: the mindfuel
Domain: mindfuel.ca

Name: The MindFuel Foundation
norm: the mindfuel
Domain: mindfuel.ca
Industry: EducationllmTechnologyllm

Discovered: May 5, 2025
Breach occurred: May 5, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Third-Party / Supply Chain
Third party: via third-party service provider

During the incident: Removed the data from the database
Triggered a reset of the password on Wonderville accounts
Established a secure location for file transfers
Established a process to remove legacy accounts
Changes made: Established a secure location for file transfers
Established a process to remove legacy accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJun 20 · first

Washington State AG+3d

California State AG+3d · this page

Texas State AG+10d

Pattern: first filing Jun 20 (IN), last Jun 30 (TX) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-604372
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2025
Raw hash: b90050337b925b0c6fea867c8631ac0fa85bbffb9ae6f9c8c09f04ec32365ba4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe MindFuel Foundation

Victim entityThe MindFuel Foundation

Incidentdiscovered May 5, 2025

Stated responseRemoved the data from the database

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov