HackingTechnologyTelecom & MediaInformationStolen CredentialsPeaceCustomer Data InvolvedData ExfiltratedCredentialsIdentity (basic)LowActive

MySPACE

bd_d437d0aa412f2d18 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 25, 2016

Filed

Jun 3, 2016

To disclose

9 days

Affected

Not disclosed

Confidence

66%

Full breach record for MySPACE →

Myspace LLC notified users that stolen login data (email addresses, usernames, passwords) for accounts created prior to June 11, 2013, was discovered on a hacker forum in late May 2016. The breach is attributed to a Russian cyberhacker known as 'Peace'. Myspace invalidated passwords for affected accounts and reported the incident to law enforcement. No financial data was involved.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 25, 2016 → Notified May 31, 20166d ✓ CA 60-day OK9 days discovery → filing

Incident timeline

discovery → filing · 9 days

May 25, 2016

Discovered

Jun 3, 2016

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: MySPACE
norm: myspace
Domain: myspace.com.mm

Name: MySPACE
norm: myspace
Domain: myspace.com.mm
Industry: TechnologyllmTelecom & Mediallm

Discovered: May 25, 2016
Materiality determined: —
Notification sent: May 31, 2016
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unknown· Peace
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: PeaceExternal
Regulator citations: Reported the incident to law enforcement authorities
Initial access: valid_credentials

During the incident: Invalidated all user passwords for the affected accounts created prior to June 11, 2013 on the old Myspace platform
Using automated tools to attempt to identify and block any suspicious activity that might occur on Myspace accounts
Reported the incident to law enforcement authorities and are cooperating to investigate and pursue this criminal act
Changes made: Utilizing advanced protocols including double salted hashes to store passwords
Taken additional security steps in light of the recent report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: CA 60-day OK · 6d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 25, 2016
→ Notified: May 31, 2016
6d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 25, 2016 → Notified: May 31, 2016	6d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62164
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2016
Raw hash: 3736c7d048aaf22fbc1a3cf95355b44d321741203d1e8e29a29701cf8152eea5

Reporting entityMySPACE

Victim entityMySPACE

Incidentdiscovered May 25, 2016

Stated responseInvalidated all user passwords for the affected accounts created prior to June 11, 2013 on the old Myspace platform

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov