Social EngineeringPhishingData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICCREDENTIALSLowContained
Bodybuilding.com, LLC
bd_1368bb2e24bf7480 · schema v1 · pii pii-v1
Full breach record for Bodybuilding.com, LLC →Bodybuilding.com experienced a data security incident involving unauthorized access to its systems, traced to a phishing email received in July 2018. The breach potentially exposed customer names, emails, passwords, billing/shipping addresses, phone numbers, order history, birthdates, and BodySpace profile information. Bodybuilding.com engaged forensic investigators, coordinated with law enforcement, reset customer passwords, and implemented additional security measures. No evidence of credit card number access was found.
California clockDiscovered Feb 1, 2019 → Notified Apr 24, 201982d ✗ CA 60-day late11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_88f7f8ae652d1960HHS OCRfiled 2019-04-19Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-146494
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 19, 2019
- Raw hash
- 1fc765890d5b28a5f8a407fd1dee398348dc3ee9bac3dbaa383fe85bbd3d28c6
Reporting entity
- Name
- Vitalize LLCnorm: vitalize
Victim entity
- Name
- Bodybuilding.com, LLCnorm: bodybuildingcom
- Industry
- retail_consumer
Incident
- Discovered
- Feb 1, 2019
- Materiality determined
- —
- Notification sent
- Apr 24, 2019
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICCREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 11 weeks(77 days from discovery to filing)
- Compliance flags
- CA 60-day late · 82d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 1, 2019→ Notified: Apr 24, 201982d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.