HackingInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

TOO LOST LLC

bd_2d71718d265351de · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 31, 2026

Filed

Feb 20, 2026

To disclose

20 days

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for TOO LOST LLC →

Too Lost LLC notified the California Attorney General of a data breach involving unauthorized access to a web application between July 25, 2025, and September 2, 2025. The company became aware of the incident in late January 2026 when contacted by an unauthorized third party. The breach involved names and basic contact information (address, email, phone). Passwords were not affected. The company engaged cybersecurity experts, contacted law enforcement, and confirmed data destruction. Credit monitoring is being offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 31, 2026 → Notified Feb 20, 202620d ✓ CA 30-day OK20 days discovery → filing

Incident timeline

undetected · 190 days

discovery → filing · 20 days

Jul 25, 2025

Begins

Jan 31, 2026

Discovered

Feb 20, 2026

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Vermont State AGbd_0879145c47f3fbf52026-02-20Verified
Indiana State AGbd_32c22f44949121742026-02-20Verified by operator
New Hampshire State AGbd_373b6de6cb19f9512026-02-20Verified
Nebraska State AGbd_4ad7e3b0d8858b932026-02-20Verified

Show 5 more filings ↓up to 34d gap

Maine State AGbd_54386167de42a9932026-02-20Verified
Indiana State AGbd_a10965c99e7afc612026-02-20Verified
Massachusetts State AGbd_b2c600e1387b37c42026-02-20Verified
Texas State AGbd_8bce7e39abf24b6e2026-03-16 · +24dVerified
New Hampshire State AGbd_979e794526725f7b2026-03-26 · +34dVerified

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com

Discovered: Jan 31, 2026
Breach occurred: Jul 25, 2025 – Sep 2, 2025
Undetected for: 190 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 20, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Launched a comprehensive investigation with the assistance of cybersecurity experts
Contacted law enforcement
Took steps to confirm that the data was destroyed by the unauthorized third party
Changes made: Made efforts to reduce the likelihood of a similar incident occurring in the future
Continue to make additional improvements that strengthen our cybersecurity posture
Offering 12 months of credit monitoring and identity protection with IDX at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: CA 30-day OK · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 31, 2026
→ Notified: Feb 20, 2026
20d 30 calendar days CA 30-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 31, 2026 → Notified: Feb 20, 2026	20d	30 calendar days	CA 30-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Vermont State AGFeb 20 · first

Indiana State AGFeb 20 · first

New Hampshire State AGFeb 20 · first

Nebraska State AGFeb 20 · first

Maine State AGFeb 20 · first

Indiana State AGFeb 20 · first

Massachusetts State AGFeb 20 · first

California State AGFeb 20 · first · this page

Texas State AG+24d

New Hampshire State AG+34d

Pattern: first filing Feb 20 (VT), last Mar 26 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-619060
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2026
Raw hash: b02862fae801604faa1c2bfabc2fb820756719a9075ebd54f0f95068de6eb8b1

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityTOO LOST LLC

Victim entityTOO LOST LLC

Incidentdiscovered Jan 31, 2026

Stated responseLaunched a comprehensive investigation with the assistance of cybersecurity experts

ComplianceCA 30-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov