HackingVulnerability ExploitCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumResolved
Yellow Social Interactive Limited
bd_b186a79e9499c869 · schema v1 · pii pii-v1
Full breach record for Yellow Social Interactive Limited →Yellow Social Interactive Limited disclosed an incident on April 27, 2022, where a bug bounty hunter exploited an API vulnerability to access a supporting database. The individual accessed names, driver's license numbers, and in limited cases, passport numbers. The company fixed the vulnerability, and the individual destroyed the copied data. No evidence of misuse was found. Credit monitoring was offered to affected customers.
California clockDiscovered Apr 27, 2022 → Notified Jul 29, 202293d ✗ CA 60-day late15 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-556034
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 8, 2022
- Raw hash
- 1264a57fbff286d19b3533aee89f0bb93671c8e213f8618f93b2dcdb00878013
Reporting entity
- Name
- Yellow Social Interactive Limitednorm: yellow social interactive
Victim entity
- Name
- Yellow Social Interactive Limitednorm: yellow social interactive
Incident
- Discovered
- Apr 27, 2022
- Materiality determined
- —
- Notification sent
- Jul 29, 2022
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(103 days from discovery to filing)
- Compliance flags
- CA 60-day late · 93d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Apr 27, 2022→ Notified: Jul 29, 202293d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.