MalwareRetail & ConsumerRetailCustomer Data InvolvedSupply Chain (3P Vendor)Financial accountFinancial credentialsIdentity (basic)MediumContained

Plant Therapy

bd_0867b7e481b0e6ce · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 11, 2018

Filed

Jul 30, 2018

To disclose

11 weeks

Affected

1,074state residents only

Linked

5 filings

Confidence

65%

Full breach record for Plant Therapy →

Plant Therapy disclosed a data breach affecting approximately 1,074 California residents. On May 11, 2018, the company learned of unauthorized malware installation on its third-party e-commerce platform. The incident potentially exposed payment card information (names, card numbers, expiration dates, security codes) for customers who made purchases between March 29, 2018, and May 11, 2018. Plant Therapy engaged a forensic firm, notified the FBI and payment card brands, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 11, 2018 → Notified Jul 13, 201863d ✗ CA 60-day late11 weeks discovery → filing

Incident timeline

undetected · 43 days

discovery → filing · 11 weeks / 80 days

Mar 29, 2018

Begins

May 11, 2018

Discovered

Jul 30, 2018

Filed

vs. sector median

+4 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_3cd75aae86e56baf2018-07-30Candidate
Massachusetts State AGbd_3d9d3abb5faf53fb2018-07-30Verified
New Hampshire State AGbd_bc629abe00f8818d2018-07-30Verified
Massachusetts State AGbd_be1320f2bb0919c42018-09-21 · +53dVerified by operator

Name: Plant Therapy
norm: plant therapy

Name: Plant Therapy
norm: plant therapy
Industry: Retail & Consumerllm

Discovered: May 11, 2018
Breach occurred: Mar 29, 2018 – May 11, 2018
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2018
Affected individuals: 1,074state-resident count only
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Federal Bureau of InvestigationSubmitted the California Data Breach Reporting Form
Third party: via third-party ecommerce platform provider
Initial access: exploit_public_facing

During the incident: Took immediate steps to secure this information
Launched an investigation with a leading forensics firm
Informed the Federal Bureau of Investigation
Reported the matter to the payment card brands
Providing twenty-four months of complimentary credit and identity monitoring services to affected residents through AllClear ID
Changes made: Taken steps to enhance the security of Plant Therapy customer information and our e-commerce web platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: CA 60-day late · 63d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 11, 2018
→ Notified: Jul 13, 2018
63d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 11, 2018 → Notified: Jul 13, 2018	63d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Montana State AGJul 30 · first

Massachusetts State AGJul 30 · first

New Hampshire State AGJul 30 · first

California State AGJul 30 · first · this page

Massachusetts State AG+53d

Pattern: first filing Jul 30 (MT), last Sep 21 (MA) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138372
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2018
Raw hash: 5f7ba6aed7b3392822b76c0521720f0f4251e2270462243dc851c3e77378c81a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPlant Therapy

Victim entityPlant Therapy

Incidentdiscovered May 11, 2018

Stated responseTook immediate steps to secure this information

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov