HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIDENTITY_BASICCREDENTIALSFINANCIAL_ACCOUNTLowContained

Lime Crime, Inc.

bd_5cb99b44ae885b94 · schema v1 · pii pii-v1

Full breach record for Lime Crime, Inc. →

Lime Crime, Inc. notified customers of a cybersecurity incident where unauthorized individuals installed malicious software on the company's web server hosting limecrime.com. The breach, occurring between October 4, 2014, and February 15, 2015, compromised personal information including names, addresses, usernames, passwords, and payment card details (account number, expiration, CVV) for credit/debit card purchasers. For PayPal users, only usernames and passwords were at risk. The incident was contained, the platform replaced, and affected customers offered one year of identity protection services via Experian.

California clockDiscovered Feb 11, 2015 → Notified Feb 20, 20159d ✓ CA 60-day OK13 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Source provenance

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-48501
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2015
Raw hash: 493728ba5cb1f1596214bc4707786dcf670ef057ab67c4d2c1fb22e486b27ef6

Reporting entity

Name: Lime Crime, Inc.
norm: lime crime
Domain: limecrime.com

Victim entity

Name: Lime Crime, Inc.
norm: lime crime
Domain: limecrime.com

Incident

Discovered: Feb 11, 2015
Materiality determined: —
Notification sent: Feb 20, 2015
Affected individuals: Not disclosed
Data types: IDENTITY_BASICCREDENTIALSFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1496 Resource HijackingT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

Compliance

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: CA 60-day OK · 9d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 11, 2015
→ Notified: Feb 20, 2015
9d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 11, 2015 → Notified: Feb 20, 2015	9d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Extraction provenance

Status: No extraction artifact recorded for this disclosure.