HackingTechnologyInformationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)LocationMetadataLowResolved

Web Hosting Hub, Inc.

bd_fb5bb087a2dabf85 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 29, 2025

Filed

Apr 21, 2026

To disclose

25 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Web Hosting Hub, Inc. →

Web Hosting Hub, Inc. disclosed an unauthorized access incident affecting its Help Center. An external actor gained temporary access between April 17, 2025, and October 29, 2025, when the company detected the activity. The incident involved email addresses, IP addresses, and public-facing social media information. No financial data, passwords, or sensitive personal data were accessed. The company contained the incident, took systems offline, and engaged cybersecurity experts and law enforcement. The investigation is complete.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 29, 2025 → Notified Apr 6, 2026159d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

undetected · 195 days

discovery → filing · 25 weeks / 174 days

Apr 17, 2025

Begins

Oct 29, 2025

Discovered

Apr 21, 2026

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Texas State AGbd_683d1d1e4242fd302026-04-22 · +1dVerified
Washington State AGbd_8a948a3d21468a142026-04-20 · +1dVerified

Name: Web Hosting Hub, Inc.
norm: web hosting hub
Domain: webhostinghub.com

Name: Web Hosting Hub, Inc.
norm: web hosting hub
Domain: webhostinghub.com
Industry: Technologyllm

Discovered: Oct 29, 2025
Breach occurred: Apr 17, 2025 – Oct 29, 2025
Undetected for: 195 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)LocationMetadata
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Coordinated with law enforcement authorities

During the incident: Investigated the matter with the assistance of independent cybersecurity experts and law enforcement
Immediately contained the incident
Took the affected systems offline
Implemented additional security measures to prevent recurrence
Fully secured the affected webpage and strengthened our security controls, including enhanced monitoring and access restrictions
Notifying all potentially affected individuals as required by applicable law
Continue to monitor for any signs of misuse related to this incident
Documented the breach internally as required by applicable law
Changes made: Implemented additional security measures to prevent recurrence
Strengthened our security controls, including enhanced monitoring and access restrictions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: CA 60-day late · 159dCA AG copy ≤15d · 15d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 29, 2025
→ Notified: Apr 6, 2026
159d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Apr 6, 2026
→ AG copy submitted: Apr 21, 2026
15d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 29, 2025 → Notified: Apr 6, 2026	159d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Apr 6, 2026 → AG copy submitted: Apr 21, 2026	15d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGApr 20 · first

California State AG+1d · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-622075
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2026
Raw hash: 8c4048703b06d4eed423b4bfe60d868df428f7274aeb272e4881daf35b09939e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWeb Hosting Hub, Inc.

Victim entityWeb Hosting Hub, Inc.

Incidentdiscovered Oct 29, 2025

Stated responseInvestigated the matter with the assistance of independent cybersecurity experts and law enforcement

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov