HackingTechnologyInformationCustomer Data InvolvedIdentity (basic)CredentialsLowContained

Glofox

bd_f06e14f02c8cb6b0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 14, 2020

Filed

Dec 9, 2020

To disclose

25 days

Affected

Not disclosed

Confidence

65%

Full breach record for Glofox →

Glofox Inc. disclosed that an unknown third party gained unauthorized access to user data archived from March 27, 2020. The incident was discovered on November 14, 2020. Affected data includes names, email addresses, phone numbers, hashed passwords, and optional dates of birth. No plain text passwords or financial data were exposed. Glofox reset affected passwords and closed the access path.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 232 days

discovery → filing · 25 days

Mar 27, 2020

Begins

Nov 14, 2020

Discovered

Dec 9, 2020

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Glofox
norm: glofox
Domain: app.glofox.com

Name: Glofox
norm: glofox
Domain: app.glofox.com
Industry: Technologyllm

Discovered: Nov 14, 2020
Breach occurred: Mar 27, 2020
Undetected for: 232 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notify our relevant data protection supervisory authorities

During the incident: Reset your Glofox account password and the passwords related to your staff
Identified and closed the path that led to the unauthorised access
Changes made: Significantly invested in our security infrastructure over the past 12 months
Continue to invest in our infrastructure to prevent incidents like this in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196919
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2020
Raw hash: 58686deada167c5012707c348f4b2821cddf38706f1dfca2aae7978d318613b8

Reporting entityGlofox

Victim entityGlofox

Incidentdiscovered Nov 14, 2020

Stated responseReset your Glofox account password and the passwords related to your staff

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov