MisuseTechnologyRetail & ConsumerInformationData MishandlingEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Rakuten USA, Inc.

bd_3174790e2060a4d9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 21, 2021

Filed

Feb 11, 2021

To disclose

21 days

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Rakuten USA, Inc. →

Rakuten USA, Inc. (DBA Rakuten Americas) notified the California Attorney General of a data breach involving an employee who transferred files containing sensitive personal information (name, SSN, date of birth) of other employees to a personal device while voluntarily leaving the company. The incident was detected on January 21, 2021. The company deleted the files from the personal device, contacted law enforcement, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Jan 21, 2021

Begins

Jan 21, 2021

Discovered

Feb 11, 2021

Filed

vs. sector median

16 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_57c9021e9307b3f72021-02-11Verified
Montana State AGbd_5b9c71cefac703172021-02-11Candidate
Maine State AGbd_d667a4564196f04a2021-02-11Verified
New Hampshire State AGbd_3748bb1494a21cbc2021-02-18 · +7dVerified

Show 1 more filing ↓up to 7d gap

Indiana State AGbd_8175a8bc61f31f992021-02-04 · +7dVerified

Name: Rakuten USA, Inc.
norm: rakuten usa

Name: Rakuten USA, Inc.
norm: rakuten usa
Also named: Rakuten USA, Inc.dba oflegal entity
Rakuten Americasdba oftrade name
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jan 21, 2021
Breach occurred: Jan 21, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Providing notice to appropriate regulatory authorities
Initial access: insider_action

During the incident: Launched an investigation into the nature and scope of their activity
Immediately took steps to limit potential further exposure of the data
Deleting copies of the files from a personal device and account where they were discovered
Been in touch with law enforcement
Offering access to complimentary credit monitoring, fraud consultation, and identity theft restoration services through TransUnion
Providing notice to appropriate regulatory authorities
Reviewing existing policies and procedures
Changes made: Implement additional safeguards, as needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGFeb 4 · first

Massachusetts State AG+7d

Montana State AG+7d

Maine State AG+7d

California State AG+7d · this page

New Hampshire State AG+14d

Pattern: first filing Feb 4 (IN), last Feb 18 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537958
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 11, 2021
Raw hash: 29f9ddf62a0a22e7fc4761484afbf8dd517fc149d7a87ae7e4cc20748ca9d8dc

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityRakuten USA, Inc.

Victim entityRakuten USA, Inc.

Incidentdiscovered Jan 21, 2021

Stated responseLaunched an investigation into the nature and scope of their activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov