HackingSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Natural Wellness
bd_3928429513090d1e · schema v1 · pii pii-v1
Full breach record for Natural Wellness →Natural Wellness, a commercial entity based in Montgomery, NY, reported a third-party service provider breach affecting 7,664 individuals, including 26 Maine residents. The incident occurred between September 18, 2020, and February 3, 2022, and was discovered on July 29, 2022. The breach compromised names and financial account/credit card numbers. Written notification was sent on December 9, 2022.
Maine clockDiscovered Jul 29, 2022 → Filed with AG Dec 9, 2022133d ✗ ME AG >90d19 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7,664 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/53ce2a66-0499-4963-bc48-aad87c2bb4cf.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 9, 2022
- Raw hash
- ef98c9583b33d10d5ed9b0cfa39e0680ede89e9899f12dcd28de6c08d4bde7ae
Reporting entity
- Name
- Natural Wellnessnorm: natural wellness
Victim entity
- Name
- Natural Wellnessnorm: natural wellness
Incident
- Discovered
- Jul 29, 2022
- Materiality determined
- —
- Notification sent
- Dec 9, 2022
- Affected individuals
- 7,664
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- supply_chain
Compliance
- Time to disclose
- 19 weeks(133 days from discovery to filing)
- Compliance flags
- ME AG >90d · 133dME resident >60d · 133d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 29, 2022→ Filed with AG: Dec 9, 2022133d 90 days ME AG >90d Maine Discovered: Jul 29, 2022→ Notified: Dec 9, 2022133d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.