AccidentalRetail & ConsumerRetailMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowResolved

Academic Therapy Publications

bd_0782cd846a38ba24 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 14, 2021

Filed

Oct 14, 2021

To disclose

4 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Academic Therapy Publications →

Academic Therapy Publications experienced a data breach due to an improperly secured administrative feature on its website, allowing unauthorized access to customer data between January 6, 2020, and July 25, 2021. The incident was discovered on September 14, 2021, after the payment processor alerted the company. Affected data includes names, addresses, phone numbers, emails, and credit/debit card numbers with expiration dates. The company corrected the configuration issue and added security measures.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 14, 2021 → Notified Sep 20, 20216d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

undetected · 617 days

discovery → filing · 4 weeks / 30 days

Jan 6, 2020

Begins

Sep 14, 2021

Discovered

Oct 14, 2021

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Academic Therapy Publications
norm: academic therapy publications
Domain: academictherapy.com

Name: Academic Therapy Publications
norm: academic therapy publications
Domain: academictherapy.com
Industry: Retail & Consumerllm

Discovered: Sep 14, 2021
Breach occurred: Jan 6, 2020 – Jul 25, 2021
Undetected for: 617 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 20, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the California Attorney General of this incident
Initial access: exploit_public_facing

During the incident: Corrected the security configuration problem
Added additional security measures
Reported this incident to our payment processor
Notified the California Attorney General of this incident
Changes made: Added additional security measures to decrease the possibility of this happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 6d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 14, 2021
→ Notified: Sep 20, 2021
6d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 14, 2021 → Notified: Sep 20, 2021	6d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-546488
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2021
Raw hash: c3ece14d6b4751e834b9d7efefc8092998e0cb707fad40fe4f3bc9cce897c8d5

Reporting entityAcademic Therapy Publications

Victim entityAcademic Therapy Publications

Incidentdiscovered Sep 14, 2021

Stated responseCorrected the security configuration problem

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov