HackingTechnologyRetail & ConsumerInformationCustomer Data InvolvedIdentity (basic)CredentialsMediumActive

ShopStyle Inc.

bd_6cab76e6761a7db5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 5, 2018

Filed

Oct 24, 2018

To disclose

16 weeks

Affected

3,368state residents only

Confidence

66%

Full breach record for ShopStyle Inc. →

ShopStyle Inc. discovered unauthorized activity on July 5, 2018, revealing that an exposed key permitted potential unauthorized access to account credentials (email addresses/usernames and hashed passwords) between April 16 and April 27, 2018. Approximately 3,368 California residents were affected. The company engaged forensic investigators, rotated credentials, and reset user passwords. No evidence of actual misuse was found, but notice was sent out of an abundance of caution.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 80 days

discovery → filing · 16 weeks / 111 days

Apr 16, 2018

Begins

Jul 5, 2018

Discovered

Oct 24, 2018

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,368 affectedView incident

Name: ShopStyle Inc.
norm: shopstyle
Domain: shopstyle.com

Name: ShopStyle Inc.
norm: shopstyle
Domain: shopstyle.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Jul 5, 2018
Breach occurred: Apr 16, 2018 – Apr 27, 2018
Undetected for: 80 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 24, 2018
Affected individuals: 3,368state-resident count only
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Providing notice of this event to other state regulators as required by law

During the incident: Commenced an investigation to determine the nature and scope of the activity
Working with a third party forensic investigator
Rotated all corporate access keys and credentials of the impacted systems
Audited reviewed its internal security procedures
Provided notice to potentially affected individuals
Providing notice of this event to other state regulators as required by law
Changes made: Implementing a user password reset for those accounts potentially affected by this incident
Made improvements to our internal security procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141108
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2018
Raw hash: 707ccd94adcd335d03362ca08e74f7f00199531f245ffa8d16322296d3f57b93

Reporting entityShopStyle Inc.

Victim entityShopStyle Inc.

Incidentdiscovered Jul 5, 2018

Stated responseCommenced an investigation to determine the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov