Social EngineeringEducationEducationPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Institute for Integrative Nutrition

bd_65eda9899217f6a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 22, 2020

Filed

Aug 16, 2020

To disclose

8 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Institute for Integrative Nutrition →

Institute for Integrative Nutrition (IIN) experienced a phishing incident where an unauthorized party accessed an employee email account between March 3-4, 2020. The organization discovered the incident on June 22, 2020, after forensic investigation revealed the account contained customer names and Social Security numbers. IIN secured the account, engaged external cybersecurity professionals, and is offering one year of complimentary credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date8 weeks discovery → filing

Incident timeline

undetected · 111 days

discovery → filing · 8 weeks / 55 days

Mar 3, 2020

Begins

Jun 22, 2020

Discovered

Aug 16, 2020

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Institute for Integrative Nutrition
norm: institute for integrative nutrition
Domain: integrativenutrition.com

Name: Institute for Integrative Nutrition
norm: institute for integrative nutrition
Domain: integrativenutrition.com
Industry: Educationllm

Discovered: Jun 22, 2020
Breach occurred: Mar 3, 2020 – Mar 4, 2020
Undetected for: 111 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 22, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Secured the account
Commenced a prompt and thorough investigation
Worked very closely with external cybersecurity professionals
Conducted extensive forensic investigation and manual document review
Offering a complimentary one-year membership of Experian IdentityWorksSM Credit 3B
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193125
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2020
Raw hash: 3e108d3a8426339a27bcb811556544cfd80426e1a9ad2b4882834414f99485cf

Reporting entityInstitute for Integrative Nutrition

Victim entityInstitute for Integrative Nutrition

Incidentdiscovered Jun 22, 2020

Stated responseSecured the account

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov