HackingStolen CredentialsPhishingCustomer Data InvolvedData ExfiltratedIDENTITY_BASICFINANCIAL_ACCOUNTCREDENTIALSLowContained
Tatcha
bd_43b51c5041f2d350 · schema v1 · pii pii-v1
Full breach record for Tatcha →Tatcha, LLC reported a data breach occurring in early 2017 where an unauthorized actor accessed information entered during the online checkout process. Affected data included credit card numbers, expiration dates, CVVs, email addresses, passwords, names, and addresses. Tatcha notified affected individuals in May 2017, offered 24 months of identity protection via AllClear ID, and reported the incident to law enforcement.
California clockDiscovered Apr 15, 2017 → Notified May 5, 201720d ✓ CA 60-day OK4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-68868
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 16, 2017
- Raw hash
- 03ebf321725d7a0c9dd33554d7aa2035a777e236407e4f65f494e88117d2f802
Reporting entity
- Name
- Tatchanorm: tatcha
- Domain
- tatcha.com
Victim entity
- Name
- Tatchanorm: tatcha
- Domain
- tatcha.com
Incident
- Discovered
- Apr 15, 2017
- Materiality determined
- May 2, 2017
- Notification sent
- May 5, 2017
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Reported the matter to law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 20d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Apr 15, 2017→ Notified: May 5, 201720d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.