AccidentalMisdeliveryData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumResolved
Flurish Inc.
bd_01a06f041ef29f23 · schema v1 · pii pii-v1
Full breach record for Flurish Inc. →Flurish Inc. (dba LendUp) submitted a California SB-24 breach notification regarding a 2012-2016 incident where third-party website widgets and analytics trackers inadvertently collected customer PII, including names, emails, addresses, DOBs, and SSNs. The breach was discovered in early 2016 during a routine examination. LendUp notified affected individuals, offered 12 months of AllClear ID identity protection, and implemented new controls. No misuse of data was believed to have occurred.
California clockDiscovered Jan 1, 2016 → Notified May 11, 2016131d ✗ CA 60-day late19 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_4667c499107624a7Oregon State AGfiled 2016-05-16Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-61852
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 16, 2016
- Raw hash
- 9bac90bf0e02fc73de07398c1b9efe34604c0b538526d2ad1103d77d0eeda960
Reporting entity
- Name
- Flurish Inc.norm: flurish
Victim entity
- Name
- Flurish Inc.norm: flurish
Incident
- Discovered
- Jan 1, 2016
- Materiality determined
- —
- Notification sent
- May 11, 2016
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Initial access
- supply_chain
Compliance
- Time to disclose
- 19 weeks(136 days from discovery to filing)
- Compliance flags
- CA 60-day late · 131d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 1, 2016→ Notified: May 11, 2016131d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.