Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsBehaviorLowContained

Bodybuilding.com, LLC

bd_1368bb2e24bf7480 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2019

Filed

Apr 19, 2019

To disclose

11 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Bodybuilding.com, LLC →

Bodybuilding.com (Vitalize, LLC) disclosed a data breach affecting customer accounts. Unauthorized access originated from a phishing email received in July 2018, but the incident was not discovered until February 2019. The investigation confirmed that some data was exfiltrated, though the specific files are unknown. Affected data may include names, email addresses, passwords, billing/shipping addresses, phone numbers, order history, birthdates, and BodySpace profile information. Full credit card numbers were not stored. The company engaged forensic consultants, reset passwords, and coordinated with law enforcement.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 1, 2019 → Notified Apr 24, 201982d ✗ CA 60-day late11 weeks discovery → filing

Incident timeline

undetected · 215 days

discovery → filing · 11 weeks / 77 days

Jul 1, 2018

Begins

Feb 1, 2019

Discovered

Apr 19, 2019

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_88f7f8ae652d19602019-04-19Verified
Delaware State AGbd_fb96d8d61123e0162019-06-24 · +66dVerified

Name: Vitalize LLC
norm: vitalize
Domain: bodybuilding.com

Name: Bodybuilding.com, LLC
norm: bodybuildingcom
Domain: bodybuilding.com
Industry: Retail & Consumerllm

Discovered: Feb 1, 2019
Breach occurred: Jul 1, 2018 – Jul 31, 2018
Undetected for: 215 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsBehavior
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Coordinating with law enforcement to investigate the incident
Initial access: phishing_link

During the incident: Engaged one of the leading data security firms to conduct a thorough investigation
Took steps to understand the nature and scope of the data security incident
Brought in external forensic consultants that specialize in cyber attacks
Working with leading security experts to address any vulnerabilities and remediate the incident
Continue to monitor our systems for unauthorized access
Introduced additional security measures
Resetting Bodybuilding.com customers’ passwords on their next log-in
Coordinating with law enforcement to investigate the incident
Changes made: Address any vulnerabilities and remediate the incident
Introduced additional security measures
Resetting Bodybuilding.com customers’ passwords on their next log-in
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: CA 60-day late · 82d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 1, 2019
→ Notified: Apr 24, 2019
82d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 1, 2019 → Notified: Apr 24, 2019	82d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRApr 19 · first

California State AGApr 19 · first · this page

Delaware State AG+66d

Pattern: first filing Apr 19 (ID), last Jun 24 (DE) — a 66-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-146494
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 19, 2019
Raw hash: 1fc765890d5b28a5f8a407fd1dee398348dc3ee9bac3dbaa383fe85bbd3d28c6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityVitalize LLC

Victim entityBodybuilding.com, LLC

Incidentdiscovered Feb 1, 2019

Stated responseEngaged one of the leading data security firms to conduct a thorough investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov