HackingRetail & ConsumerHealthcareRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Agoura Health Products, LLC

bd_151b7361f0b238bd · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 30, 2020

Filed

Dec 17, 2020

To disclose

7 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Agoura Health Products, LLC →

Gundry MD (Agoura Health Products, LLC) notified customers of a data breach involving its payment processor, 1ShoppingCart. An unauthorized third party accessed 1ShoppingCart's systems between August 6 and August 22, 2020, potentially collecting names, addresses, phone numbers, email addresses, and payment card information (including CVV codes) for transactions on Gundry MD's website. Gundry MD learned of the incident on October 30, 2020. No Social Security numbers were involved. The company is working with 1ShoppingCart to determine the full impact and has advised customers to monitor their accounts for fraud.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 30, 2020 → Notified Oct 30, 20200d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 85 days

discovery → filing · 7 weeks / 48 days

Aug 6, 2020

Begins

Oct 30, 2020

Discovered

Dec 17, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_a43a25bea2e0427e2020-12-17Verified
Massachusetts State AGbd_ca0b4aad5a5277d72020-12-17Verified
Maine State AGbd_e3ab1886f9b4b1912020-12-17Candidate

Name: Agoura Health Products, LLC
norm: agoura health products

Name: Agoura Health Products, LLC
norm: agoura health products
Also named: Agoura Health Products, LLCdba oflegal entity
Gundry MDdba oftrade name
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Oct 30, 2020
Breach occurred: Aug 6, 2020 – Aug 22, 2020
Undetected for: 85 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via 1ShoppingCart
Initial access: trusted_relationship

During the incident: Requested that 1ShoppingCart provide additional information about the incident
Obtained a list of individuals who may have been impacted
Worked with 1ShoppingCart to obtain additional information about the nature of the event
Confirmed that some personal information may have been affected by the incident
Provided notice to affected individuals
Changes made: Recommended that customers remain vigilant to protect against potential fraud
Recommended reviewing account statements and credit reports closely
Provided information on how to place fraud alerts and credit freezes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: CA 60-day OK · 0d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 30, 2020
→ Notified: Oct 30, 2020
0d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 30, 2020 → Notified: Oct 30, 2020	0d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGDec 17 · first

Massachusetts State AGDec 17 · first

Maine State AGDec 17 · first

California State AGDec 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-197272
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2020
Raw hash: fc49dc92c3717f69dc487cbfa5d3570f3b4efa77906a7e882f69709e2789535b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAgoura Health Products, LLC

Victim entityAgoura Health Products, LLC

Incidentdiscovered Oct 30, 2020

Stated responseRequested that 1ShoppingCart provide additional information about the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov