HackingTechnologyInformationStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationCredentialsIdentity (basic)PIIHighContained

Neopets, Inc.

bd_bcf7f1594aab0370 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 20, 2022

Filed

Aug 29, 2022

To disclose

6 weeks

Affected

788,415state residents only

Linked

4 filings

Confidence

71%

Full breach record for Neopets, Inc. →

Neopets, Inc. notified the Washington AG of a data breach affecting 788,415 state residents. Unauthorized access occurred between Jan 3, 2021, and July 19, 2022. Data accessed included names, emails, usernames, DOBs, and hashed passwords. Neopets engaged forensic investigators, reset passwords, and enhanced security controls.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 563 days

discovery → filing · 6 weeks / 40 days

Jan 3, 2021

Begins

Jul 20, 2022

Discovered

Aug 29, 2022

Filed

vs. sector median

13 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Delaware State AGbd_d34d1216cd8513822022-08-29Verified
Oregon State AGbd_6571d70e99ce508f2022-08-30 · +1dVerified
California State AGbd_cb51d7fca5b18e2c2022-08-30 · +1dVerified

Name: Orrick, Herrington & Sutcliffe LLP
norm: orrick herrington sutcliffe
Domain: orrick.com

Name: Neopets, Inc.
norm: neopets
Domain: neopets.com
Industry: Technologyllm

Discovered: Jul 20, 2022
Breach occurred: Jan 3, 2021 – Jul 19, 2022
Undetected for: 563 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2022
Affected individuals: 788,415state-resident count only
Data types: PIIIdentity (basic)Credentials
Data elements: NameDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Office of the Attorney General, Washington

During the incident: Took immediate steps to shut down further access to the affected systems
Launched an investigation assisted by a leading forensics firm
Engaged with law enforcement
Reset players' passwords
Began notifying Washington residents via substitute notice
Changes made: Working on adding multi-factor authentication to better safeguard access to players' accounts
Enhanced the protection of its systems
Further strengthening its network monitoring
Strengthening authentication
Strengthening system protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Delaware State AGAug 29 · first

Washington State AGAug 29 · first · this page

Oregon State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13822.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2022
Raw hash: 89f950fb63fc68207421c962af5e44bbbdf762f75eec5a691bd2ed71cc15eb85

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOrrick, Herrington & Sutcliffe LLP

Victim entityNeopets, Inc.

Incidentdiscovered Jul 20, 2022

Stated responseTook immediate steps to shut down further access to the affected systems

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com