HackingRetail & ConsumerRetailVulnerability ExploitCapture App DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsPIILowContained

GlamGlow LLC

bd_6db5b35c861b8361 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 8, 2015

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

77%

Full breach record for GlamGlow LLC →

GlamGlow LLC reported unauthorized access to its glamglowmud.com website. The incident occurred in two windows: approximately September 19–21, 2014 and May 12–15, 2015 (mail letter), or approximately May 18, 2014 to May 20, 2015 (email letter). Compromised data included names, addresses, phone numbers, payment card numbers/expiration dates/security codes, email addresses, and account passwords. GlamGlow engaged outside experts, secured the site, and offered one year of free Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

May 18, 2014

Begins

Oct 8, 2015

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_50f3c445b14822022015-10-08Verified
Massachusetts State AGbd_a5e6739f0352b1ff2015-10-13 · +5dVerified

Name: GlamGlow LLC
norm: glamglow
Domain: glamglowmud.com

Name: GlamGlow LLC
norm: glamglow
Domain: glamglowmud.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 18, 2014 – May 20, 2015
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountCredentialsPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation and retained outside experts to help understand the nature and scope of the issue
Promptly took steps to remediate the issue and secure the site
Arranged to offer credit monitoring services to affected customers for one year at no cost to them
Revamping the website and asking affected individuals to re-register their accounts once the new website is live
Changes made: Secured the glamglowmud.com website
Revamping the website
Recommended affected individuals change passwords on any other website using the same or similar password as the GlamGlow website
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 8 · first

California State AGOct 8 · first · this page

Massachusetts State AG+5d

Pattern: first filing Oct 8 (NH), last Oct 13 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-58194
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2015
Raw hash: 334e7108d9860e7c8fc3e8214f8c7393b2c83a172b5437931d4d314ca536cd58

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGlamGlow LLC

Victim entityGlamGlow LLC

IncidentUnauthorized Access

Stated responseLaunched an investigation and retained outside experts to help understand the nature and scope of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov