HackingTechnologyInformationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsAuthenticationLowContained

Fishbrain AB

bd_660669e664a46085 · schema v1 · pii pii-v2

Severity

Low

Discovered

Aug 19, 2026

Filed

Sep 2, 2026

To disclose

14 days

Affected

Not disclosed

Confidence

65%

Full breach record for Fishbrain AB →

Fishbrain AB notified California residents of a data breach where an unauthorized person accessed user data, including names, emails, phone numbers, usernames, password hashes, salts, and dates of birth. The unauthorized access occurred as early as July 30, 2026, and was discovered on August 19, 2026. Fishbrain reset passwords, terminated sessions, patched the vulnerability, and restricted access to the affected environment.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 19, 2026 → Notified Sep 1, 202613d ✓ CA 30-day OK14 days discovery → filing

Incident timeline

undetected · 20 days

discovery → filing · 14 days

Jul 30, 2026

Begins

Aug 19, 2026

Discovered

Sep 2, 2026

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Fishbrain AB
norm: fishbrain
Domain: fishbrain.com

Name: Fishbrain AB
norm: fishbrain
Domain: fishbrain.com
Industry: Technologyllm

Discovered: Aug 19, 2026
Breach occurred: Jul 30, 2026
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Commenced a forensic investigation
Reset passwords for affected accounts
Terminated active sessions on Fishbrain
Patched the vulnerability
Restricted access to the affected environment
Changes made: Enhancing our security protocols
Conducting a broader review of our data security measures
Monitoring our systems to help protect against future unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 30-day OK · 13dCA AG copy ≤15d · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 19, 2026
→ Notified: Sep 1, 2026
13d 30 calendar days CA 30-day OK
California
Consumers notified: Sep 1, 2026
→ AG copy submitted: Sep 2, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 19, 2026 → Notified: Sep 1, 2026	13d	30 calendar days	CA 30-day OK
California	Consumers notified: Sep 1, 2026 → AG copy submitted: Sep 2, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629190
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2026
Raw hash: 424e46653ebbbfe200112d42e8a945075d800f97ffc37c4c413a2e1c144a2dbb

Reporting entityFishbrain AB

Victim entityFishbrain AB

Incidentdiscovered Aug 19, 2026

Stated responseCommenced a forensic investigation

ComplianceCA 30-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov