HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)CredentialsBehaviorMediumActive

Arbonne International, LLC

bd_392ca32a8c55ec06 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 20, 2020

Filed

May 22, 2020

To disclose

5 weeks

Affected

3,527state residents only

Confidence

66%

Full breach record for Arbonne International, LLC →

Arbonne International, LLC reported unauthorized access to internal systems on April 20, 2020. The incident potentially exposed names, addresses, usernames, passwords, and order history for 3,527 California residents. The company forced password resets, engaged third-party investigators, notified the FBI, and offered one year of identity monitoring through Kroll. The investigation was ongoing at the time of the notice.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 20, 2020 → Notified Apr 24, 20204d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 32 days

Apr 20, 2020

Begins

Apr 20, 2020

Discovered

May 22, 2020

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,527 affectedView incident

Name: Arbonne International, LLC
norm: arbonne international

Name: Arbonne International, LLC
norm: arbonne international
Industry: Retail & Consumerllm

Discovered: Apr 20, 2020
Breach occurred: Apr 20, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2020
Affected individuals: 3,527state-resident count only
Data types: Identity (basic)CredentialsBehavior
Attack vector: Unknown
Regulator citations: Reported this matter to the FBI and relevant regulators

During the incident: Commenced an investigation with the assistance of third-party computer specialists
Forced a password reset for all user accounts whose passwords may have been subject to unauthorized access
Provided access to credit monitoring and identity protection services for one year through Kroll
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Reported this matter to the FBI and relevant regulators
Changes made: Reviewing and enhancing existing policies and procedures
Implementing additional safeguards
Additional employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: CA 60-day OK · 4d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 20, 2020
→ Notified: Apr 24, 2020
4d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 20, 2020 → Notified: Apr 24, 2020	4d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190320
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2020
Raw hash: 79359f097920d5df0d9abbcf179a7ad183e8321ac4b2d72ffc5058d2c1617619

Reporting entityArbonne International, LLC

Victim entityArbonne International, LLC

Incidentdiscovered Apr 20, 2020

Stated responseCommenced an investigation with the assistance of third-party computer specialists

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov