HackingTechnologyRetail & ConsumerInformationStolen CredentialsCustomer Data InvolvedCredentialsIdentity (basic)LowContained

Havenly

bd_38976802f335e279 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 31, 2020

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for Havenly →2 incidents on file

Havenly, Inc. reported that an outside individual gained unauthorized access to a database containing usernames and hashed passwords of users on or around June 25, 2020. The affected data included first and last names, account usernames, and hashed passwords. No credit card numbers or billing addresses were stored or affected. Havenly logged out all users, forced password resets, and engaged a forensic firm on July 29, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 25, 2020

Begins

Aug 31, 2020

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Havenly
norm: havenly
Domain: havenly.com

Name: Havenly
norm: havenly
Domain: havenly.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: —
Breach occurred: Jun 25, 2020
Materiality determined: —
Notification sent: Jul 29, 2020
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Been in contact with federal law enforcement regarding this matter

During the incident: Logged all Havenly users out of their accounts
Performed a password reset
Initiated an internal investigation
Retained an independent forensic investigation firm to assist us in our investigation and response
Been in contact with federal law enforcement regarding this matter
Enhancing security measures related to our user database
Changes made: Resetting passwords
Enhancing security measures related to our user database
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193576
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2020
Raw hash: 377b2d4fea698ff1b0c05d7726ee4f4a14cac193bfaf2a979256b065cc2b9a58

Reporting entityHavenly

Victim entityHavenly

IncidentUnauthorized Access

Stated responseLogged all Havenly users out of their accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov