HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHighContained

TaskRabbit, Inc.

bd_82ea7962b8663782 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 12, 2018

Filed

May 18, 2018

To disclose

5 weeks

Affected

4,062state residents only

Linked

9 filings

Confidence

66%

Full breach record for TaskRabbit, Inc. →

TaskRabbit, Inc. notified Hawaii AG of a cybersecurity incident discovered on April 12, 2018, where an unauthorized party accessed systems. Compromised data included names, usernames, passwords, DOB, SSN, bank account numbers, and truncated payment card info. TaskRabbit engaged forensic investigators, notified law enforcement, reset passwords, and offered 12 months of Experian identity restoration services.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 5 weeks / 36 days

Apr 12, 2018

Discovered

May 18, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

South Carolina State AGbd_eb27196153c239ef2018-05-18Verified
Massachusetts State AGbd_5059aa7345f48be52018-05-17 · +1dVerified
Oregon State AGbd_f7f9d351d3e380422018-05-16 · +2dVerified
California State AGbd_2bacd9f8cd21af182018-05-14 · +4dVerified

Show 4 more filings ↓up to 9d gap

New Hampshire State AGbd_3362df920fc5f7912018-05-14 · +4dVerified
Delaware State AGbd_43620444acac76152018-05-14 · +4dVerified
Washington State AGbd_1481d340ac00ffaf2018-05-09 · +9dCandidate
Montana State AGbd_35cb01ef23965c772018-05-09 · +9dVerified

Name: TaskRabbit, Inc.
norm: taskrabbit
Domain: taskrabbit.com

Name: TaskRabbit, Inc.
norm: taskrabbit
Domain: taskrabbit.com
Industry: Technologyllm

Discovered: Apr 12, 2018
Materiality determined: —
Notification sent: May 10, 2018
Affected individuals: 4,062state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Hawaii Office of the Attorney General

During the incident: Hired an outside forensics firm to investigate the incident
Promptly informed, and continue to work with, law enforcement
Identified and closed the point of entry used by the unauthorized party
Conducted scans of our systems to identify and address other potential vulnerabilities
Reset all user passwords on April 19, 2018
Arranged for Experian to provide one year of identity restoration services
Changes made: Examining ways to make our login process more secure
Evaluating our data retention practices to reduce the amount of data we hold
Enhancing overall network cyber threat detection technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Washington State AGMay 9 · first

Montana State AGMay 9 · first

California State AG+5d

New Hampshire State AG+5d

Delaware State AG+5d

Oregon State AG+7d

Massachusetts State AG+8d

South Carolina State AG+9d

Hawaii State AG+9d · this page

Pattern: first filing May 9 (WA), last May 18 (HI) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2018/11/TaskRabbit_Inc_OCP_2018-0206.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2018
Raw hash: 86dfb67cbb921c6f4bb14a44e76f73e42ba73a1afd482a226d23ba86954e3689

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTaskRabbit, Inc.

Victim entityTaskRabbit, Inc.

Incidentdiscovered Apr 12, 2018

Stated responseHired an outside forensics firm to investigate the incident

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org