HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Health (basic)Financial accountLowContained

JAND Inc.

bd_51d95883578ecc22 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 26, 2018

Filed

Dec 20, 2018

To disclose

24 days

Affected

951state residents only

Linked

4 filings

Confidence

66%

Full breach record for JAND Inc. →

JAND Inc. d/b/a Warby Parker notified Washington AG of a credential stuffing incident affecting 951 state residents. Unauthorized parties used stolen credentials from other breaches to attempt logins between Sept 25 and Nov 26, 2018. No proof of actual data access was found, but accounts potentially contained names, emails, prescriptions, and partial card info. Customers were required to reset passwords.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 62 days

discovery → filing · 24 days

Sep 25, 2018

Begins

Nov 26, 2018

Discovered

Dec 20, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_b170633faba40bb92018-12-21 · +1dCandidate
New Hampshire State AGbd_117cd5271d2bb7d82018-12-24 · +4dVerified
Massachusetts State AGbd_512491b6332a1e102018-12-26 · +6dVerified

Name: JAND Inc.
norm: jand
Domain: warbyparker.com

Name: JAND Inc.
norm: jand
Domain: warbyparker.com
Also named: JAND Inc.dba oflegal entity
Warby Parkerdba oftrade name
Industry: Retail & Consumerllm

Discovered: Nov 26, 2018
Breach occurred: Sep 25, 2018 – Nov 26, 2018
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2018
Affected individuals: 951state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported the matter to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Began to investigate with the assistance of outside experts
Reported the matter to the Federal Bureau of Investigation
Required potentially affected users to reset their passwords upon log-in
Engaged third-party cybersecurity experts to help
Continue to monitor site traffic closely
Actively cooperating with law enforcement
Changes made: Required all potentially affected customers to reset their passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGDec 20 · first · this page

California State AG+1d

New Hampshire State AG+4d

Massachusetts State AG+6d

Pattern: first filing Dec 20 (WA), last Dec 26 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10651.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2018
Raw hash: 207b8fa11186ddf4a8cf4fdc2cf0d7b3d5afe5b50ba2c46a7f0e2cf770faf6e3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJAND Inc.

Victim entityJAND Inc.

Incidentdiscovered Nov 26, 2018

Stated responseBegan to investigate with the assistance of outside experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com