HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHighContained

DOTERRA INTERNATIONAL, LLC

bd_05a513dc0989d756 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

May 12, 2016

To disclose

—

Affected

9,737state residents only

Linked

8 filings

Confidence

64%

Full breach record for DOTERRA INTERNATIONAL, LLC →

doTERRA International, LLC notified customers and Wellness Advocates that a third-party vendor's systems were accessed in March 2016, resulting in the unauthorized acquisition of personal information including names, SSNs, payment card data, and credentials. doTERRA engaged security experts and law enforcement, and offered 24 months of free credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Mar 1, 2016

Begins

May 12, 2016

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Hawaii State AGbd_9c78fc895e9a66872016-05-11 · +1dVerified
Oregon State AGbd_fbb6cfe862b6c98e2016-05-02 · +10dVerified
California State AGbd_2143531664cf479b2016-04-18 · +24dVerified
New Hampshire State AGbd_6a3e063adb2d639d2016-04-18 · +24dVerified

Show 3 more filings ↓up to 24d gap

Washington State AGbd_9a87e92b0eb4f9a12016-04-18 · +24dCandidate
Montana State AGbd_b620c205f026aa442016-04-18 · +24dVerified
Massachusetts State AGbd_e8aee4e3ea940ead2016-04-18 · +24dVerified

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Mar 1, 2016 – Mar 31, 2016
Materiality determined: —
Notification sent: Apr 18, 2016
Affected individuals: 9,737state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Working closely with law enforcement authorities and leading security experts
Engaged industry-leading security firms to assist
Offering identity protection and credit monitoring services for 24 months at no cost
Changes made: Investing heavily to implement state-of-the-art systems to support growth and expansion and enhance security
Reviewing and strengthening IT systems and protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SC CRA notice due
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGApr 18 · first

New Hampshire State AGApr 18 · first

Washington State AGApr 18 · first

Montana State AGApr 18 · first

Massachusetts State AGApr 18 · first

Oregon State AG+14d

Hawaii State AG+23d

South Carolina State AG+24d · this page

Pattern: first filing Apr 18 (CA), last May 12 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/doTerraInternational%2CLLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2016
Raw hash: 78cbc20b4afb638d877ea0b192addc0cca67dc977394d50edf2351f782d8b823

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDOTERRA INTERNATIONAL, LLC

Victim entityDOTERRA INTERNATIONAL, LLC

IncidentThird-Party / Supply Chain

Stated responseWorking closely with law enforcement authorities and leading security experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov