HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Used Bikes Direct, LLC
bd_0d931829eaaef72e · schema v1 · pii pii-v1
Full breach record for Used Bikes Direct, LLC →Used Bikes Direct, LLC (UBD) notified the Idaho Attorney General of a data breach affecting 6 Idaho residents. Beginning January 17, 2025, a malicious actor compromised UBD's authorized login credentials for the CRSS Credit API (Portal). The actor accessed historical consumer credit reports and personal information, including names, SSNs, addresses, and salary data. The breach was discovered by CRS in March 2025. UBD offered 12 months of credit monitoring via TransUnion/Cyberscout and implemented MFA and additional security reviews.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_486f611ee9a2d6caNew Hampshire State AGfiled 2025-05-12Verified
- bd_72dd0eca397c56caIndiana State AGfiled 2025-05-12Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2025/05/2025-05-12-UBD-Notification-Letter-to-Idaho.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 12, 2025
- Raw hash
- f79020344247e6320ad3063999cb685429c1794d8a5026e239b8ba86ca451a97
Reporting entity
- Name
- Kean Miller LLPnorm: kean miller
Victim entity
- Name
- Used Bikes Direct, LLCnorm: used bikes direct
Incident
- Discovered
- Mar 1, 2025
- Materiality determined
- —
- Notification sent
- May 12, 2025
- Affected individuals
- 6
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office Consumer Protection Division
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 10 weeks(72 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.