HackingTechnologyInformationStolen CredentialsData ExfiltratedMulti-Stage ChainPIIIdentity (basic)CredentialsLowContained

Neopets, Inc.

bd_d34d1216cd851382 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 20, 2022

Filed

Aug 29, 2022

To disclose

6 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

63%

Full breach record for Neopets, Inc. →

Neopets, Inc. issued a supplemental notice regarding a data breach where unauthorized third-party access occurred between January 2021 and July 2022. The incident affected player personal information including names, emails, usernames, DOBs, and hashed passwords. Neopets engaged forensic investigators and law enforcement, reset passwords, and enhanced security controls. No specific affected individual count was provided in this notice.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 563 days

discovery → filing · 6 weeks / 40 days

Jan 3, 2021

Begins

Jul 20, 2022

Discovered

Aug 29, 2022

Filed

vs. sector median

13 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_bcf7f1594aab03702022-08-29Candidate
Oregon State AGbd_6571d70e99ce508f2022-08-30 · +1dVerified
California State AGbd_cb51d7fca5b18e2c2022-08-30 · +1dVerified

Name: Neopets, Inc.
norm: neopets
Domain: neopets.com

Name: Neopets, Inc.
norm: neopets
Domain: neopets.com
Industry: Technologyllm

Discovered: Jul 20, 2022
Breach occurred: Jan 3, 2021 – Jul 19, 2022
Undetected for: 563 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2022
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Engaged with law enforcement

During the incident: Took immediate steps to shut down further access to the affected systems
Launched an investigation assisted by a leading forensics firm
Engaged with law enforcement
Reset players' passwords
Working on adding multi-factor authentication
Enhanced the protection of our systems, including by further strengthening our network monitoring, authentication, and system protection
Changes made: Adding multi-factor authentication to better safeguard account access
Further strengthening network monitoring
Strengthening authentication
Strengthening system protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGAug 29 · first

Delaware State AGAug 29 · first · this page

Oregon State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/09/Neopets-2022.08.29-Substitute-Notice-Website-Press-Release-4136-6077-9325-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2022
Raw hash: 810b39322d1e03d3ebdf4836f8dae9dd0164fa0a3a40aa4e32584b5f66c27eee

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNeopets, Inc.

Victim entityNeopets, Inc.

Incidentdiscovered Jul 20, 2022

Stated responseTook immediate steps to shut down further access to the affected systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov