HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsLocationLowContained

Animoto Inc.

bd_61c65dd351456886 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 10, 2018

Filed

Aug 16, 2018

To disclose

5 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Animoto Inc. →

Animoto Inc. notified the California AG of unauthorized access to user data on July 10, 2018. The incident involved suspicious queries against the user database, potentially exposing names, emails, hashed/salted passwords, geolocation, gender, and dates of birth. Animoto stopped the queries, engaged third-party experts, reset passwords, and reduced system access. No payment card data was accessed. Notices were sent starting August 16, 2018.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 10, 2018 → Notified Aug 16, 201837d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 37 days

Jul 10, 2018

Begins

Jul 10, 2018

Discovered

Aug 16, 2018

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Animoto Inc.
norm: animoto

Name: Animoto Inc.
norm: animoto
Industry: Technologyllm

Discovered: Jul 10, 2018
Breach occurred: Jul 10, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 16, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsLocation
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified California Attorney General

During the incident: Stopped the queries and launched an investigation with the assistance of third-party experts
Changed employee passwords
Urging all users to change their passwords immediately
Replaced system passwords
Reduced the number of users who could access certain systems
Continues to monitor for suspicious activity
Rebuilding infrastructure to make it more secure
Examining ways to enhance overall network cyber threat detection technology
Reported this incident to law enforcement
Changes made: Implementing additional safeguards
Rebuilding infrastructure to make it more secure
Enhancing overall network cyber threat detection technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: CA 60-day OK · 37d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 10, 2018
→ Notified: Aug 16, 2018
37d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 10, 2018 → Notified: Aug 16, 2018	37d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138932
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2018
Raw hash: d09c71e7808ab8e6b835a83800d9e104067f6db5b89d0d910e641e898b2f4847

Reporting entityAnimoto Inc.

Victim entityAnimoto Inc.

Incidentdiscovered Jul 10, 2018

Stated responseStopped the queries and launched an investigation with the assistance of third-party experts

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov