HackingStolen CredentialsCustomer Data InvolvedIdentity (basic)LowContained

HumanEdge

bd_87a425b64d8a72e1 · schema v1 · pii pii-v2

Severity

Low

Discovered

Mar 17, 2026

Filed

Sep 2, 2026

To disclose

24 weeks

Affected

Not disclosed

Linked

6 records

Confidence

65%

Full breach record for HumanEdge →

HumanEdge, Inc. experienced unauthorized access to its network on March 17-18, 2026. The company discovered suspicious activity on March 17, 2026, and initiated an investigation with cybersecurity experts. The investigation concluded on August 14, 2026, determining that certain files may have been accessed or acquired without authorization. Affected data may include names and email addresses. HumanEdge is offering 12 months of identity protection services through O9M.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 17, 2026 → Notified Sep 1, 2026168d ✗ CA 30-day late24 weeks discovery → filing

Incident timeline

discovery → filing · 24 weeks / 169 days

Mar 17, 2026

Begins

Mar 17, 2026

Discovered

Sep 2, 2026

Filed

This filing is one of 6 records about the same incident.View merged incident

A leak claim by qilin about this victim was first seen 97 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_1e6431027be2d5d62026-05-28 · +97dVerified

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_1a9964dee57fb4cb2026-09-02Verified
Texas State AGbd_4c85e04fd64e97752026-09-03 · +1dVerified
Indiana State AGbd_e7e2496b26f7e4292026-09-01 · +1dCandidate
Massachusetts State AGbd_fcd071244e4551842026-09-01 · +1dVerified

Name: HumanEdge
norm: humanedge
Domain: humanedge.com

Name: HumanEdge
norm: humanedge
Domain: humanedge.com

Discovered: Mar 17, 2026
Breach occurred: Mar 17, 2026 – Mar 18, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Initiated an investigation with the assistance of cybersecurity experts
Conducted a comprehensive review of those files to determine the nature of the information involved and the individuals to whom it pertained
Worked to locate address information to notify individuals as quickly as possible
Implemented measures to further enhance the security of our network and minimize the risk of a similar incident occurring in the future
Changes made: Offering you the opportunity to enroll in identity protection services through O9M
O9M identity protection services include 12 months of credit and cyberhack monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: CA 30-day late · 168dLeak >90dCA AG copy ≤15d · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 17, 2026
→ Notified: Sep 1, 2026
168d 30 calendar days CA 30-day late
California
Consumers notified: Sep 1, 2026
→ AG copy submitted: Sep 2, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 17, 2026 → Notified: Sep 1, 2026	168d	30 calendar days	CA 30-day late
California	Consumers notified: Sep 1, 2026 → AG copy submitted: Sep 2, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 1 · first

Massachusetts State AGSep 1 · first

Vermont State AG+1d

California State AG+1d · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629213
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2026
Raw hash: 3781b7254342481099b9f331818135bf72405c750f7b87fe4a63b3c8f2d4c636

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityHumanEdge

Victim entityHumanEdge

Incidentdiscovered Mar 17, 2026

Stated responseInitiated an investigation with the assistance of cybersecurity experts

ComplianceCA 30-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov