Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Natural Beauty

bd_3ba2128791ab2d22 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2026

Filed

May 29, 2026

To disclose

28 days

Affected

638state residents only

Confidence

66%

Full breach record for Natural Beauty →

KerberRose S.C. notified the Iowa AG of a data incident affecting 638 Iowa residents. An unauthorized third party accessed an employee email account on April 29, 2026, gaining limited access to a backup platform for wealth management services. Data exposed included names, SSNs, DOBs, and financial account info. Notifications were sent on May 29, 2026, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Iowa clock✓ IA AG ≤5 bday28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 28 days

Apr 29, 2026

Begins

May 1, 2026

Discovered

May 29, 2026

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed638 affectedView incident

Name: KerberRose S.C.
norm: kerberrrose
Domain: natbeauty.com

Name: Natural Beauty
norm: natural beauty
Domain: natbeauty.com
Industry: Financial Servicesllm

Discovered: May 1, 2026
Breach occurred: Apr 29, 2026
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2026
Affected individuals: 638state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Iowa Attorney General
Initial access: phishing_link

During the incident: Isolated the impacted environment
Began an investigation with the help of a leading forensic security firm
Provided notice to affected individuals via U.S. Mail
Offered 24-months of identity monitoring and theft resolution services through Cyberscout
Changes made: Implemented additional administrative and technical safeguards
Strengthened password policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: IA AG ≤5 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/5292026_KerberRose_S_235D776B3242E.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: c7dd2138a3c7aed132717f724ca3560cf898c1d5e127d212ec6e919604fedbb2

Reporting entityKerberRose S.C.

Victim entityNatural Beauty

Incidentdiscovered May 1, 2026

Stated responseIsolated the impacted environment

ComplianceIA AG ≤5 bday

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov