HackingFinancial ServicesTechnologyFinanceStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

SharesPost, Inc.

bd_d768ac12c9781933 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 30, 2019

Filed

Dec 27, 2019

To disclose

13 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for SharesPost, Inc. →2 incidents on file

SharesPost, Inc. disclosed that an unauthorized party gained access to an employee email account between September 6 and 18, 2019. The incident was discovered on September 30, 2019. The compromised account contained shareholder application forms for the SharesPost 100 Fund, potentially exposing names, addresses, dates of birth, Social Security numbers, contact information, and bank account numbers. SharesPost implemented security enhancements to halt access and is offering identity theft protection services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 30, 2019 → Notified Dec 20, 201981d ✗ CA 60-day late13 weeks discovery → filing

Incident timeline

undetected · 24 days

discovery → filing · 13 weeks / 88 days

Sep 6, 2019

Begins

Sep 30, 2019

Discovered

Dec 27, 2019

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_4027aa69c0f966bf2019-12-20 · +7dCandidate
Indiana State AGbd_65fbd18ed880865f2019-12-20 · +7dVerified

Name: SharesPost, Inc.
norm: sharespost
Domain: sharespost.com

Name: SharesPost, Inc.
norm: sharespost
Domain: sharespost.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Sep 30, 2019
Breach occurred: Sep 6, 2019 – Sep 18, 2019
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Halted access via internal security enhancements
Investigated the scope of the Incident and potentially affected individuals
Reviewed policies and operational processes
Implemented additional information security measures
Offering identity theft protection services through ID Experts
Changes made: Reviewed policies and operational processes
Implemented additional information security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(88 days from discovery to filing)
Compliance flags: CA 60-day late · 81d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 30, 2019
→ Notified: Dec 20, 2019
81d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 30, 2019 → Notified: Dec 20, 2019	81d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGDec 20 · first

Indiana State AGDec 20 · first

California State AG+7d · this page

Pattern: first filing Dec 20 (MT), last Dec 27 (CA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-185464
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2019
Raw hash: ef64a2bf1af59941639180f00e8051285674b232b4d6a1cd6e0c621469df3caa

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySharesPost, Inc.

Victim entitySharesPost, Inc.

Incidentdiscovered Sep 30, 2019

Stated responseHalted access via internal security enhancements

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov