MalwareTechnologyInformationRansomwareData ExfiltratedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Big Fish Games, Inc.

bd_8e8d945628de6bc3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 12, 2015

Filed

Feb 10, 2015

To disclose

29 days

Affected

146state residents only

Linked

3 filings

Confidence

66%

Full breach record for Big Fish Games, Inc. →

Big Fish Games, Inc. notified the NH AG of a security breach affecting 146 NH residents. Malware intercepted payment details (name, address, card number, CVV) entered between Dec 24, 2014 and Jan 8, 2015. Self-discovered Jan 12, 2015. Response included malware removal, forensic investigation, and notifying card networks and law enforcement. Affected individuals offered Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 19 days

discovery → filing · 29 days

Dec 24, 2014

Begins

Jan 12, 2015

Discovered

Feb 10, 2015

Filed

vs. sector median

15 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_ae6b5b6ce854235a2015-02-13 · +3dCandidate
Massachusetts State AGbd_7eed9184c57cab992015-02-18 · +8dVerified

Name: Big Fish Games, Inc.
norm: big fish games
Domain: bigfishgames.com

Name: Big Fish Games, Inc.
norm: big fish games
Domain: bigfishgames.com
Industry: Technologyllm

Discovered: Jan 12, 2015
Breach occurred: Dec 24, 2014 – Jan 8, 2015
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 10, 2015
Affected individuals: 146state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified State of New Hampshire Department of Justice
Initial access: exploit_public_facing

During the incident: Taken necessary steps to remove the malware and prevent it from being reinstalled
Retained security forensics firms to assist in investigating the incident
Informed the payment card networks about this incident
Reported the incident to and is cooperating with law enforcement
Informed the credit reporting agencies about this incident
Changes made: Offering a complimentary one-year membership to Experian’s ProtectMyID Alert
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 10 · first · this page

California State AG+3d

Massachusetts State AG+8d

Pattern: first filing Feb 10 (NH), last Feb 18 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/big-fish-games-20150210.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 10, 2015
Raw hash: fb107c20dae7abba5dc3d7c073378b045b6180e91764aeed3fdf9de461bc454e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBig Fish Games, Inc.

Victim entityBig Fish Games, Inc.

Incidentdiscovered Jan 12, 2015

Stated responseTaken necessary steps to remove the malware and prevent it from being reinstalled

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov