HackingRetail & ConsumerRetailStolen CredentialsCapture App DataCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)LowResolved

CorePower Yoga, LLC

bd_6407da81d56308e9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 11, 2020

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

74%

Full breach record for CorePower Yoga, LLC →3 incidents on file

CorePower Yoga, LLC notified the California AG of unauthorized access to multiple employee email accounts between November 7, 2019 and February 3, 2020. A third-party forensic specialist completed its analysis on August 13, 2020. The investigation could not determine which emails were accessed, but personal information (name and other elements) may have been exposed. Affected individuals were offered 12 months of free credit monitoring through TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 7, 2019

Begins

Sep 11, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_24361a985b46a6852020-09-11Candidate
Massachusetts State AGbd_5b7eda2bd08537f22020-09-11Verified
Indiana State AGbd_6116d52de2311f872020-09-11Verified
New Hampshire State AGbd_15b3d885b5a57d8b2020-09-17 · +6dVerified

Name: CorePower Yoga, LLC
norm: corepower yoga

Name: CorePower Yoga, LLC
norm: corepower yoga
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 7, 2019 – Feb 3, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Changed the CorePower employee account passwords at issue
Reviewed existing security measures
Engaged a third-party forensic specialist to investigate the incident
Conducted a review of all emails and attachments in the affected email accounts to identify sensitive information
Offering twelve (12) months of free credit and identity monitoring through TransUnion
Changes made: Working diligently to implement additional security measures to ensure the security of our network
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGSep 11 · first

Massachusetts State AGSep 11 · first

Indiana State AGSep 11 · first

California State AGSep 11 · first · this page

New Hampshire State AG+6d

Pattern: first filing Sep 11 (WA), last Sep 17 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193986
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2020
Raw hash: 366fe4c41a90bb22e5de171cf47326110387b7104c11117ae8f128fcee0e83fb

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCorePower Yoga, LLC

Victim entityCorePower Yoga, LLC

IncidentUnauthorized Access

Stated responseChanged the CorePower employee account passwords at issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov