HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Healing Touch Day Spa Inc./Whatgreatskin.com

bd_21daec4380da1030 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 28, 2012

Filed

Sep 11, 2012

To disclose

14 days

Affected

Not disclosed

Confidence

65%

Full breach record for Healing Touch Day Spa Inc./Whatgreatskin.com →

Healing Touch Day Spa Inc./Whatgreatskin.com reported an organized attack on its servers on August 28, 2012. The incident potentially compromised customer names, addresses, and credit card details. The company took the site offline, wiped credit card data from its database, and initiated a security audit. No specific count of affected individuals was disclosed in the notification.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 28, 2012 → Notified Aug 28, 2012✓ CA 60-day OK14 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 13 days

Aug 28, 2012

Begins

Aug 28, 2012

Discovered

Sep 11, 2012

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Healing Touch Day Spa Inc./Whatgreatskin.com
norm: healing touch day spa inc whatgreatskincom
Domain: whatgreatskin.com

Name: Healing Touch Day Spa Inc./Whatgreatskin.com
norm: healing touch day spa inc whatgreatskincom
Domain: whatgreatskin.com
Industry: Retail & Consumerllm

Discovered: Aug 28, 2012
Breach occurred: Aug 28, 2012 – Aug 28, 2012
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2012
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: WhatGreatSkin.com was immediately taken offline to prevent further access
All credit card information was wiped from our secure database
Performing a complete security audit
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 60-day OK
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 28, 2012
→ Notified: Aug 28, 2012
— 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 28, 2012 → Notified: Aug 28, 2012	—	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-36413
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2012
Raw hash: 25de4492196973866196f6c3c78fa843addbecfad1002d3835f7f71ae65edcab

Reporting entityHealing Touch Day Spa Inc./Whatgreatskin.com

Victim entityHealing Touch Day Spa Inc./Whatgreatskin.com

Incidentdiscovered Aug 28, 2012

Stated responseWhatGreatSkin.com was immediately taken offline to prevent further access

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov