HackingTechnologyInformationStolen CredentialsDelayed DiscoveryData ExfiltratedTargetedPIICredentialsFinancial accountMediumActive

US VALVE CORPORATION

bd_8c3f8bd898a5063a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2011

Filed

Feb 8, 2012

To disclose

13 weeks

Affected

6,400state residents only

Linked

2 filings

Confidence

66%

Full breach record for US VALVE CORPORATION →2 incidents on file

Valve Corporation notified NH AG of a data security incident affecting ~6,400 NH residents. Intrusion discovered Nov 6, 2011 (forum defacement); data likely exfiltrated in 2009. Affected data: usernames, emails, encrypted billing/credit card info. Investigation ongoing with outside experts and FBI.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1039 days

discovery → filing · 13 weeks / 94 days

Jan 1, 2009

Begins

Nov 6, 2011

Discovered

Feb 8, 2012

Filed

vs. sector median

+2 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_5d1139df452962f02012-02-08Candidate

Name: US VALVE CORPORATION
norm: us valve
Domain: valvesoftware.com

Name: US VALVE CORPORATION
norm: us valve
Domain: valvesoftware.com
Industry: Technologyllm

Discovered: Nov 6, 2011
Breach occurred: Jan 1, 2009
Undetected for: 1,039 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2012
Affected individuals: 6,400state-resident count only
Data types: PIICredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of JusticeWorking with the Seattle FBI office
Initial access: exploit_public_facing

During the incident: Investigation continued with the help of outside security experts
Working with the Seattle FBI office
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGFeb 8 · first

New Hampshire State AGFeb 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/valve-corporation-20120208.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2012
Raw hash: 0ad3dc8ee6fb6bdbe0b204a58de322b4cd5b8b2518b7e1d4a275983793eed40f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUS VALVE CORPORATION

Victim entityUS VALVE CORPORATION

Incidentdiscovered Nov 6, 2011

Stated responseInvestigation continued with the help of outside security experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov