HackingTechnologyInformationStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDCredentialsAuthenticationMediumResolved

eMinor Incorporated

bd_9316a34c0226ad42 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 2, 2015

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

80%

Full breach record for eMinor Incorporated →

In January 2014, an individual illegally accessed a ReverbNation vendor's computer systems and gained unauthorized access to user data in a database backup. Exposed data included names, SSNs, employer IDs, email addresses, encrypted passwords, postal addresses, phone numbers, and dates of birth. No credit card data was affected. ReverbNation was alerted by law enforcement and sent consumer notices on September 2, 2015. The individual has since been identified and charged.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2014

Begins

Sep 2, 2015

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_2f9ae7cf1ee13c962015-09-17 · +15dVerified
Massachusetts State AGbd_52b44d209cd799602015-09-18 · +16dVerified

Name: eMinor Incorporated
norm: eminor
Domain: reverbnation.com

Name: eMinor Incorporated
norm: eminor
Domain: reverbnation.com
Also named: eMinor Incorporateddba oflegal entity
ReverbNationdba oftrade name
Industry: Technologyllm

Discovered: —
Breach occurred: Jan 1, 2014 – May 31, 2014
Materiality determined: —
Notification sent: Sep 2, 2015
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDCredentialsAuthentication
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Notified California Attorney GeneralContacted by law enforcement who alerted ReverbNation to the unauthorized access
Initial access: trusted_relationship

During the incident: Alerted by law enforcement that an individual had illegally sought to gain unauthorized access to customer user data
Reset all ReverbNation user passwords as a precaution
Sent email notice to affected users regarding password reset
Sent written notice to California residents whose SSN may have been affected
Changes made: Taken additional steps to further secure our system against any such breaches
Strongly encouraging all users to change their ReverbNation passwords
Recommending password management tools like 1Password and LastPass
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGSep 2 · first · this page

South Carolina State AG+15d

Massachusetts State AG+16d

Pattern: first filing Sep 2 (CA), last Sep 18 (MA) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-57665
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2015
Raw hash: 9d6a8a9a77ea0472fd6c66327c43b680f59ce6900126789ab463afb88bc1507e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityeMinor Incorporated

Victim entityeMinor Incorporated

IncidentThird-Party / Supply Chain

Stated responseAlerted by law enforcement that an individual had illegally sought to gain unauthorized access to customer user data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov