MisuseHealthcareFinancial ServicesHealthcareData MishandlingCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Bodies of America, LLC

bd_2f3d2b131b1c2842 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 24, 2018

To disclose

—

Affected

Not disclosed

Confidence

64%

Full breach record for Bodies of America, LLC →

Bodies of America, LLC, a medical spa services provider, improperly used a TransUnion product to acquire personal information (name, address, DOB, SSN, driver's license) of individuals between Feb 2017 and Aug 2018. TransUnion discovered the misuse while assisting law enforcement and suspended the customer's access. Notices were sent in Oct 2018 offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 22, 2017

Begins

Oct 24, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: TransUnion
norm: transunion
Domain: transunion.com

Name: Bodies of America, LLC
norm: bodies of america
Industry: HealthcarellmFinancial Servicesllm

Discovered: —
Breach occurred: Feb 22, 2017 – Aug 27, 2018
Materiality determined: —
Notification sent: Oct 24, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Assisting law enforcement with an investigation
Initial access: trusted_relationship

During the incident: Suspended Bodies of America’s access to this product
Changes made: Offering one year of free credit monitoring services via myTrueIdentity
Providing guidance on placing fraud alerts and credit freezes
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bodies-of-america-20181024.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2018
Raw hash: 0991a2fba48cf8feaff5f13b504d9d67671b69a1b56c54ecc2ec0a11beda16b7

Reporting entityTransUnion

Victim entityBodies of America, LLC

IncidentThird-Party / Supply Chain

Stated responseSuspended Bodies of America’s access to this product

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov