HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountEmploymentMediumContained

Used Bikes Direct, LLC

bd_0d931829eaaef72e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2025

Filed

May 12, 2025

To disclose

10 weeks

Affected

6state residents only

Linked

6 filings

Confidence

68%

Full breach record for Used Bikes Direct, LLC →

Used Bikes Direct, LLC (UBD) notified the Idaho Attorney General of a data breach affecting 6 Idaho residents. Beginning January 17, 2025, a malicious actor compromised UBD's authorized login credentials for the CRSS Credit API (Portal). The actor accessed historical consumer credit reports and personal information, including names, SSNs, addresses, and salary data. The breach was discovered by CRS in March 2025. UBD offered 12 months of credit monitoring via TransUnion/Cyberscout and implemented MFA and additional security reviews.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 10 weeks / 72 days

Jan 17, 2025

Begins

Mar 1, 2025

Discovered

May 12, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_06cd443689c4f87b2025-05-12Verified
New Hampshire State AGbd_486f611ee9a2d6ca2025-05-12Verified
Indiana State AGbd_72dd0eca397c56ca2025-05-12Verified
Nebraska State AGbd_d67a1c392cb12c252025-05-12Verified

Show 1 more filing ↓up to 8d gap

Idaho State AGbd_238b19b9966123422025-05-20 · +8dVerified

Name: Kean Miller LLP
norm: kean miller

Name: Used Bikes Direct, LLC
norm: used bikes direct
Industry: Retail & Consumerllm

Discovered: Mar 1, 2025
Breach occurred: Jan 17, 2025
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General's Office Consumer Protection Division
Initial access: valid_credentials

During the incident: CRS immediately blocked further access to that account
Implemented additional authentication procedures, including multi-factor authentication
Implemented additional training requirements
Conducting thorough reviews for steps to further implement additional safeguards, policies, and procedures relating to data privacy and security
Offering affected consumers 12 months of credit monitoring and identity theft protection services through TransUnion
Established a dedicated, toll-free call center to answer questions
Changes made: Implemented additional authentication procedures, including multi-factor authentication
Implemented additional training requirements
Conducting thorough reviews for steps to further implement additional safeguards, policies, and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 12 · first

New Hampshire State AGMay 12 · first

Indiana State AGMay 12 · first

Nebraska State AGMay 12 · first

Idaho State AGMay 12 · first · this page

Idaho State AG+8d

Pattern: first filing May 12 (MA), last May 20 (ID) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/05/2025-05-12-UBD-Notification-Letter-to-Idaho.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2025
Raw hash: f79020344247e6320ad3063999cb685429c1794d8a5026e239b8ba86ca451a97

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityKean Miller LLP

Victim entityUsed Bikes Direct, LLC

Incidentdiscovered Mar 1, 2025

Stated responseCRS immediately blocked further access to that account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov