HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedTargetedAuthenticationCredentialsIdentity (basic)HighContained

Mammoth Media, Inc.

bd_a3bc26ffce5fcf4d · schema v1 · pii pii-v1

Severity

High

Discovered

May 20, 2020

Filed

Aug 17, 2020

To disclose

13 weeks

Affected

9,380,000

Confidence

67%

Full breach record for Mammoth Media, Inc. →

Mammoth Media, Inc. reported a cybersecurity incident affecting Wishbone app users. Unauthorized access occurred on Jan 27, 2020, via stolen credentials. Discovered May 20, 2020. Data exposed included names, emails, hashed passwords, phone numbers, and birthdates. ~9.38M US residents affected. Remediation included password resets, MFA, and data purging.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d13 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 114 days

discovery → filing · 13 weeks / 89 days

Jan 27, 2020

Begins

May 20, 2020

Discovered

Aug 17, 2020

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9,380,000 affectedView incident

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Mammoth Media, Inc.
norm: mammoth media
Industry: Technologyllm

Discovered: May 20, 2020
Breach occurred: Jan 27, 2020
Undetected for: 114 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2020
Affected individuals: 9,380,000nationwide
Data types: AuthenticationCredentialsIdentity (basic)
Data elements: NameDate of birthUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the Washington Office of the Attorney General
Initial access: valid_credentials

During the incident: Engaged incident response counsel and a digital forensics firm
Provided email notification to all Wishbone registered users
Provided website notice of the incident
Invalidated any current access methods to user information
Updated keys accordingly
Ensured that all employees or services which require access use cybersecurity approved multi-factor authentication
Implementing stronger security and encryption of personal information
Changes made: Global password reset for all registered users
Adding another layer of security to encrypted registered user passwords
Purging registered users’ birthdates from its databases
Implementation of multi-factor authentication (“MFA”) for the affected systems
Performing an audit of and updating access permissions on such systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10246.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2020
Raw hash: 0f9c86e229b2c8b9bebe017fd67bf1bd04248b32e4d65d394158fdb75a0de75a

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityMammoth Media, Inc.

Incidentdiscovered May 20, 2020

Stated responseEngaged incident response counsel and a digital forensics firm

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com