DisclosureLens
HackingTechnologyInformationStolen CredentialsTargetedIdentity (basic)Financial accountLowContained

Zenfolio

bd_8f1bba3013c7c5db · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 14, 2019

Filed

Mar 13, 2019

To disclose

27 days

Affected

1state residents only

Confidence

66%
All records for Zenfolio →

Account takeover notice

Zenfolio notified customers of unauthorized access to their accounts. The filing says: “Zenfolio's investigation determined that these unauthorized parties were using passwords and user names stolen or obtained primarily from other web sites that Zenfolio's customers may use.”

Zenfolio, Inc. notified the New Hampshire Attorney General of a security incident affecting one NH resident. Unauthorized parties used credentials stolen from other websites to access customer accounts between Feb 3-17, 2019. Affected data included name, address, email, phone, and ACH bank details. Zenfolio discovered the attempt on Feb 14, 2019, engaged forensic investigators, reset passwords, and implemented stricter password requirements.

Incident timeline

undetected · 11 days
discovery → filing · 27 days

Feb 3, 2019

Begins

Feb 14, 2019

Discovered

Mar 13, 2019

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.