HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedPIICREDENTIALSCriticalContained
MyHeritage
bd_7da14bb6cb2c83cc · schema v1 · pii pii-v1
Full breach record for MyHeritage →MyHeritage Ltd. disclosed a data breach affecting 92,283,889 users. The incident, occurring on October 26, 2017, involved the unauthorized access and exfiltration of user email addresses and hashed passwords. The breach was discovered on June 4, 2018, when a security researcher notified the company. MyHeritage responded by engaging forensic investigators, notifying authorities, expiring all user passwords, and enabling Two-Factor Authentication.
California clockDiscovered Jun 4, 2018 → Notified Jun 4, 20180d ✓ CA 60-day OK10 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_edd95cdc5a37bd69Delaware State AGfiled 2018-06-15Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-137155
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 15, 2018
- Raw hash
- fb3963c3e74dd00017f19fae00ca7d7d71809f84afb346787d9e58e41fe0ff50
Reporting entity
- Name
- MyHeritagenorm: myheritage
- Domain
- myheritage.com
Victim entity
- Name
- MyHeritagenorm: myheritage
- Domain
- myheritage.com
Incident
- Discovered
- Jun 4, 2018
- Materiality determined
- —
- Notification sent
- Jun 4, 2018
- Affected individuals
- 92,283,889
- Data types
- PIICREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified relevant authorities as per GDPR
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 10 days(10 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 4, 2018→ Notified: Jun 4, 20180d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.