HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

Used Bikes Direct, LLC

bd_238b19b996612342 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2025

Filed

May 20, 2025

To disclose

8 weeks

Affected

6state residents only

Linked

6 filings

Confidence

67%

Full breach record for Used Bikes Direct, LLC →

Used Bikes Direct, LLC reported a data breach affecting 6 Idaho residents. Beginning Jan 17, 2025, a malicious actor compromised UBD's account with third-party credit platform CRS using stolen credentials. The actor accessed historical consumer credit reports containing names, SSNs, addresses, and salary info. CRS detected the compromise in March 2025. UBD notified the Idaho AG on May 12, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 70 days

discovery → filing · 8 weeks / 53 days

Jan 17, 2025

Begins

Mar 28, 2025

Discovered

May 20, 2025

Filed

vs. sector median

2 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_06cd443689c4f87b2025-05-12 · +8dVerified
Idaho State AGbd_0d931829eaaef72e2025-05-12 · +8dCandidate
New Hampshire State AGbd_486f611ee9a2d6ca2025-05-12 · +8dVerified
Indiana State AGbd_72dd0eca397c56ca2025-05-12 · +8dVerified

Show 1 more filing ↓up to 8d gap

Nebraska State AGbd_d67a1c392cb12c252025-05-12 · +8dVerified

Name: Used Bikes Direct, LLC
norm: used bikes direct

Name: Used Bikes Direct, LLC
norm: used bikes direct
Industry: Retail & Consumerllm

Discovered: Mar 28, 2025
Breach occurred: Jan 17, 2025
Undetected for: 70 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General's Office
Third party: via CRS (CRSS Credit API)
Initial access: valid_credentials

During the incident: CRS immediately blocked further access to that account
UBD is offering affected consumers 12 months of credit monitoring and identity theft protection services through TransUnion
Established a dedicated, toll-free call center to answer questions
Changes made: Implemented additional authentication procedures, including multi-factor authentication
Implemented additional training requirements
Conducting thorough reviews for steps to further implement additional safeguards, policies, and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 12 · first

Idaho State AGMay 12 · first

New Hampshire State AGMay 12 · first

Indiana State AGMay 12 · first

Nebraska State AGMay 12 · first

Idaho State AG+8d · this page

Pattern: first filing May 12 (MA), last May 20 (ID) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/05/Used-Bikes-Direct-LLC-Supplemental-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: f8519a0439cdab20085150f4bca1f37c7bc869a3e32cccf4875c89dca1bbc218

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityUsed Bikes Direct, LLC

Victim entityUsed Bikes Direct, LLC

Incidentdiscovered Mar 28, 2025

Stated responseCRS immediately blocked further access to that account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov