HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Nutraceutical Wellness Inc.

bd_1e3b7d44403fab44 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 11, 2019

Filed

Oct 16, 2019

To disclose

5 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Nutraceutical Wellness Inc. →

Nutraceutical Wellness Inc. dba Nutrafol reported a data breach to the California Attorney General. The incident occurred on April 10, 2019, and was discovered on September 11, 2019. An unauthorized third party accessed names, addresses, and credit card information. The company engaged a security firm for investigation and is enhancing security measures. The investigation was ongoing at the time of the notice.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 154 days

discovery → filing · 5 weeks / 35 days

Apr 10, 2019

Begins

Sep 11, 2019

Discovered

Oct 16, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_68ed57281dde3ec92019-10-16Candidate

Name: Nutraceutical Wellness Inc.
norm: nutraceutical wellness

Name: Nutraceutical Wellness Inc.
norm: nutraceutical wellness
Also named: Nutraceutical Wellness Inc.dba oflegal entity
Nutrafoldba oftrade name
Industry: Retail & Consumerllm

Discovered: Sep 11, 2019
Breach occurred: Apr 10, 2019
Undetected for: 154 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unknown
Threat actor: External

During the incident: Initiating an internal investigation
Retaining a nationally recognized computer security firm to assist in the investigation and respond to the incident
Reviewing and enhancing security measures
Changes made: Reviewing and enhancing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGOct 16 · first

California State AGOct 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183532
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2019
Raw hash: 202fc1de1561c41f53b2b49cf4d6f5e9a2e30eafce5461d58d7f430793f86ee7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNutraceutical Wellness Inc.

Victim entityNutraceutical Wellness Inc.

Incidentdiscovered Sep 11, 2019

Stated responseInitiating an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov