HackingTechnologyInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData PublishedCredentialsIdentity (basic)LowContained

Sonicbids LLC

bd_9cf1bfbc9f5c3faa · schema v1 · pii pii-v1

Severity

Low

Discovered

May 17, 2020

Filed

Jun 16, 2020

To disclose

4 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Sonicbids LLC →

Sonicbids LLC notified users that their usernames and passwords were publicly accessible due to unauthorized access of their third-party cloud hosting instance. The unauthorized access occurred on December 29, 2019, and was discovered on May 17, 2020. Sonicbids reset all user passwords, took the site offline, and engaged outside specialists to remediate vulnerabilities. The incident involved credentials and basic identity information (names).

J jump to incidentP pin to compareR raw source

California clockDiscovered May 17, 2020 → Notified May 17, 20200d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

undetected · 140 days

discovery → filing · 4 weeks / 30 days

Dec 29, 2019

Begins

May 17, 2020

Discovered

Jun 16, 2020

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Sonicbids LLC
norm: sonicbids
Domain: sonicbids.com

Name: Sonicbids LLC
norm: sonicbids
Domain: sonicbids.com
Industry: Technologyllm

Discovered: May 17, 2020
Breach occurred: Dec 29, 2019
Undetected for: 140 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2020
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying regulatory authorities as required by lawIn contact with federal law enforcement and are cooperating as required
Third party: via third-party cloud hosting services
Initial access: supply_chain

During the incident: Launched an investigation
Reset all Sonicbids user passwords
Took the Sonicbids site offline
Ensured appropriate permissions were restored prior to relaunching the site
Worked with outside computer specialists to identify and remediate any potential vulnerabilities within our network
Retrained our staff on data security
Notifying regulatory authorities as required by law
Been in contact with federal law enforcement and are cooperating as required
Changes made: Implement enhanced security protocols to prevent a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 0d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 17, 2020
→ Notified: May 17, 2020
0d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 17, 2020 → Notified: May 17, 2020	0d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190975
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2020
Raw hash: 4da8be59e2355d9777bdf781978677ba54bc585ca4d99397b6a3d40aa5cab5fe

Reporting entitySonicbids LLC

Victim entitySonicbids LLC

Incidentdiscovered May 17, 2020

Stated responseLaunched an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov