HackingTechnologyInformationVulnerability ExploitCapture Stored DataTargetedData ExfiltratedIdentity (basic)Financial accountAuthenticationLowContained

TrueFire

bd_837c562ff81a02ee · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 10, 2020

Filed

Mar 9, 2020

To disclose

8 weeks

Affected

21state residents only

Linked

4 filings

Confidence

65%

Full breach record for TrueFire →3 incidents on file

TrueFire LLC notified consumers of a data breach where unauthorized access to its website occurred between August 3, 2019, and January 14, 2020. The incident potentially exposed names, addresses, and payment card details (including security codes) entered during checkout. TrueFire discovered the breach on January 10, 2020, engaged forensic specialists, notified law enforcement, and provided credit monitoring guidance to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 8 weeks / 59 days

Aug 3, 2019

Begins

Jan 10, 2020

Discovered

Mar 9, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_13c0c3be1552e35c2020-03-10 · +1dVerified
California State AGbd_e89c77e7a5033b372020-03-10 · +1dVerified
Indiana State AGbd_c92d5b8102f212162020-02-13 · +25dVerified

Name: TrueFire
norm: truefire
Domain: truefirestudios.com

Name: TrueFire
norm: truefire
Domain: truefirestudios.com
Industry: Technologyllm

Discovered: Jan 10, 2020
Breach occurred: Aug 3, 2019 – Jan 14, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 9, 2020
Affected individuals: 21state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: reporting the incident to law enforcement
Initial access: exploit_public_facing

During the incident: Working with computer forensic specialists to determine the full nature and scope of the intrusion
Reporting the incident to law enforcement
Continuing to monitor all activity on the Website to ensure the intrusion remains contained
Working with an outside computer forensic team to monitor, remediate and identify any issues
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 13 · first

Montana State AG+25d · this page

Massachusetts State AG+26d

California State AG+26d

Pattern: first filing Feb 13 (IN), last Mar 10 (CA) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-76.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2020
Raw hash: affd1b54b09a34bc89d8a55994654c1fa951e741391380cbaed3db739aacaed3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTrueFire

Victim entityTrueFire

Incidentdiscovered Jan 10, 2020

Stated responseWorking with computer forensic specialists to determine the full nature and scope of the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov