HackingVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumActive
Garden of Life, LLC
bd_526e3fb4468ed092 · schema v1 · pii pii-v1
Full breach record for Garden of Life, LLC →Garden of Life, LLC notified the New Hampshire Attorney General of a data breach affecting 4 state residents. An unauthorized third party exploited an unpatched vulnerability in Oracle E-Business Suite between August 9-10, 2025, to access employee and contractor PII (names, SSNs, contact info). The company discovered the incident on November 11, 2025, isolated affected systems, engaged forensic experts, and sent notification letters on December 4, 2025, offering 24 months of identity protection services.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_f032b1f7c39531faMaine State AGfiled 2025-12-12Candidate
- bd_01940a2f5f309076Indiana State AGfiled 2025-12-04(8d gap)Verified
- bd_ef65a6f54dd21f0eVermont State AGfiled 2025-11-04(38d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/garden-life-20251212.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 12, 2025
- Raw hash
- 7e702d2168605886620cbadd3ba98c0e3a16e001c511d855cb0884fb1314daa1
Reporting entity
- Name
- Garden of Life, LLCnorm: garden of life
- Domain
- gardenoflife.com
Victim entity
- Name
- Garden of Life, LLCnorm: garden of life
- Domain
- gardenoflife.com
Incident
- Discovered
- Nov 11, 2025
- Materiality determined
- —
- Notification sent
- Dec 4, 2025
- Affected individuals
- 4
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General's Office
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.