AccidentalOtherMisdeliveryData ExfiltratedCustomer Data InvolvedAuthenticationCredentialsIdentity (basic)MediumContained

The MindFuel Foundation

bd_629fd0e890867ccb · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 5, 2025

Filed

Jun 23, 2025

To disclose

7 weeks

Affected

1,205state residents only

Linked

4 filings

Confidence

70%

Full breach record for The MindFuel Foundation →

The Mindfuel Foundation notified Washington AG of a data breach where a historical testing database snapshot, provided by a third-party service provider, was accessible to developers and potentially viewed by web crawlers on May 5, 2025. Data may include names, emails, and hashed passwords for ~1,205 Washington residents. The Foundation removed the data and reset passwords.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 54 days

discovery → filing · 7 weeks / 49 days

Mar 12, 2025

Begins

May 5, 2025

Discovered

Jun 23, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_31cce346b0f712022025-06-23Candidate
Indiana State AGbd_7a2696397ac674942025-06-20 · +3dVerified
Texas State AGbd_5dd397a7edb530da2025-06-30 · +7dVerified

Name: The MindFuel Foundation
norm: the mindfuel
Domain: mindfuel.ca
Industry: Non-Profit/Charity

Name: The MindFuel Foundation
norm: the mindfuel
Domain: mindfuel.ca
Industry: Non-Profit/Charity
Industry: Otherllm

Discovered: May 5, 2025
Breach occurred: Mar 12, 2025 – May 5, 2025
Undetected for: 54 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,205state-resident count only
Data types: Identity (basic)Credentials
Data elements: NameUsername + password
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1074 Data Staged
Threat actor: External
Regulator citations: Notified Washington State Attorney General
Initial access: trusted_relationship

During the incident: Removed the data from the database
Triggered a reset of the password on Wonderville accounts
Established a secure location for file transfers
Established a process to remove legacy accounts
Changes made: Established a secure location for file transfers
Established a process to remove legacy accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJun 20 · first

California State AG+3d

Washington State AG+3d · this page

Texas State AG+10d

Pattern: first filing Jun 20 (IN), last Jun 30 (TX) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33672.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2025
Raw hash: 1a50a52ba24b7011aac98373b405c5fee5af020eef70b3a7d2e8a0b3c97b86e0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe MindFuel Foundation

Victim entityThe MindFuel Foundation

Incidentdiscovered May 5, 2025

Stated responseRemoved the data from the database

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com