HackingTechnologyTelecom & MediaInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsHighContained

Popsugar

bd_56c1281de0a9d8a4 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 30, 2018

Filed

Jun 14, 2018

To disclose

6 weeks

Affected

123,857

Confidence

65%

Full breach record for Popsugar →

POPSUGAR Inc. disclosed that an unauthorized third party gained access to account credentials and accessed user information (name, email, hashed password) for 123,857 users. The breach occurred in February 2018 and was discovered on April 30, 2018. The company engaged external providers, reset passwords, and enhanced monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 30, 2018 → Notified Jun 14, 201845d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 88 days

discovery → filing · 6 weeks / 45 days

Feb 1, 2018

Begins

Apr 30, 2018

Discovered

Jun 14, 2018

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed123,857 affectedView incident

Name: Popsugar
norm: popsugar
Domain: popsugar.com

Name: Popsugar
norm: popsugar
Domain: popsugar.com
Industry: TechnologyllmTelecom & Mediallm

Discovered: Apr 30, 2018
Breach occurred: Feb 1, 2018 – Feb 28, 2018
Undetected for: 88 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2018
Affected individuals: 123,857nationwide
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Engaged external service providers to assess our environment
Resetting user passwords
Enhancing our monitoring systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: CA 60-day OK · 45d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 30, 2018
→ Notified: Jun 14, 2018
45d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 30, 2018 → Notified: Jun 14, 2018	45d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-137129
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2018
Raw hash: d4b1468bee847b7bef519d7e452c81d4b1bd957848975dced4d64ad60363f4db

Reporting entityPopsugar

Victim entityPopsugar

Incidentdiscovered Apr 30, 2018

Stated responseEngaged external service providers to assess our environment

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov