HackingRetail & ConsumerHealthcareRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsCredentialsMediumContained

DOTERRA INTERNATIONAL, LLC

bd_2143531664cf479b · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 18, 2016

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

66%

Full breach record for DOTERRA INTERNATIONAL, LLC →

dōTERRA International, LLC notified California residents that a third-party vendor providing data hosting and software services experienced an intrusion in March 2016. The incident resulted in the unauthorized acquisition of personal information for some Wellness Advocates and customers, potentially including names, Social Security numbers, payment card information, dates of birth, addresses, phone numbers, and credentials. dōTERRA engaged security firms and law enforcement, and offered 24 months of identity protection and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 1, 2016

Begins

Apr 18, 2016

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_6a3e063adb2d639d2016-04-18Verified
Washington State AGbd_9a87e92b0eb4f9a12016-04-18Candidate
Montana State AGbd_b620c205f026aa442016-04-18Verified
Massachusetts State AGbd_e8aee4e3ea940ead2016-04-18Verified

Show 3 more filings ↓up to 24d gap

Oregon State AGbd_fbb6cfe862b6c98e2016-05-02 · +14dVerified
Hawaii State AGbd_9c78fc895e9a66872016-05-11 · +23dVerified
South Carolina State AGbd_05a513dc0989d7562016-05-12 · +24dVerified

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international
Industry: Retail & ConsumerllmHealthcarellm

Discovered: —
Breach occurred: Mar 1, 2016 – Mar 31, 2016
Materiality determined: —
Notification sent: Apr 18, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsCredentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Third party: via Third-party vendor
Initial access: supply_chain

During the incident: Engaged industry-leading security firms to assist
Working closely with law enforcement authorities
Offering identity protection and credit monitoring services for 24 months at no cost
Prompting users to change passwords
Changes made: Investing heavily to implement state-of-the-art systems to support growth and expansion and enhance security
Review and strengthen IT systems and protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

New Hampshire State AGApr 18 · first

Washington State AGApr 18 · first

Montana State AGApr 18 · first

Massachusetts State AGApr 18 · first

California State AGApr 18 · first · this page

Oregon State AG+14d

Hawaii State AG+23d

South Carolina State AG+24d

Pattern: first filing Apr 18 (NH), last May 12 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-61140
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2016
Raw hash: 40f12bf9df94d6d339312347402c0b76d2e5f0d53bab0c6815c018dc547e841b

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDOTERRA INTERNATIONAL, LLC

Victim entityDOTERRA INTERNATIONAL, LLC

IncidentThird-Party / Supply Chain

Stated responseEngaged industry-leading security firms to assist

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov