HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICCREDENTIALSFINANCIAL_ACCOUNTPIILowActive
Epik Holdings, Inc.
bd_04c8616c0dafed29 · schema v1 · pii pii-v1
Full breach record for Epik Holdings, Inc. →Epik Holdings, Inc. confirmed a data intrusion on September 15, 2021, involving unauthorized access to a backup copy of domain-side service accounts on or before September 13, 2021. Affected data includes names, addresses, emails, usernames, passwords, phone numbers, VAT numbers, transaction history, domain ownership, and for some users, credit card information. Epik retained cybersecurity partners, secured services, and offered credit monitoring.
California clockDiscovered Sep 15, 2021 → Notified Sep 15, 20210d ✓ CA 60-day OK5 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8580b47767c5ab33Maine State AGfiled 2021-09-22(2d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-545520
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 20, 2021
- Raw hash
- e5139c020a725c374cb7883009611e9d99bdbe54ac2b932869f8d9809ec2c658
Reporting entity
- Name
- Epik Holdings, Inc.norm: epik holdings
- Domain
- epik.com
Victim entity
- Name
- Epik Holdings, Inc.norm: epik holdings
- Domain
- epik.com
Incident
- Discovered
- Sep 15, 2021
- Materiality determined
- —
- Notification sent
- Sep 15, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALSFINANCIAL_ACCOUNTPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified law enforcement and other relevant authorities
Compliance
- Time to disclose
- 5 days(5 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 15, 2021→ Notified: Sep 15, 20210d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.