HackingStolen CredentialsCapture App DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPIIMediumContained

Far Niente

bd_81a61276e332a30c · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 11, 2023

To disclose

—

Affected

Not disclosed

Confidence

74%

Full breach record for Far Niente →

On April 24, 2023, an unauthorized individual gained access to certain Far Niente email accounts and internal documents. Affected data may have included names, credit card numbers or social security numbers, addresses, and contact information. Far Niente changed affected credentials, cut off access, engaged a forensic firm, and offered 24 months of complimentary Experian IdentityWorks credit monitoring to affected individuals. Notification letters were sent September 11, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 24, 2023

Begins

Sep 11, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Far Niente
norm: far niente

Name: Far Niente
norm: far niente

Discovered: —
Breach occurred: Apr 24, 2023
Materiality determined: —
Notification sent: Sep 11, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took steps to change any affected credentials
Cut off the individual's access
Engaged a leading forensic investigation firm to investigate and determine what information may have been affected
Monitored its systems for unauthorized access activity
Changes made: Offering complimentary access to Experian IdentityWorksSM for 24 months
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-573106
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2023
Raw hash: cc270986f6cd8b1addec7efb22ed679e508adf08b2e871fc75fc6e6db13b2ffd

Reporting entityFar Niente

Victim entityFar Niente

IncidentUnauthorized Access

Stated responseTook steps to change any affected credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov