HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedTargetedAuthenticationCredentialsFinancial accountIdentity (basic)MediumContained

Epik Holdings, Inc.

bd_728638994942c8ae · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2021

Filed

Sep 22, 2021

To disclose

7 days

Affected

2,040state residents only

Linked

8 filings

Confidence

69%

Full breach record for Epik Holdings, Inc. →

Epik Holdings, Inc. disclosed unauthorized access to domain-side service account backups on or before September 13, 2021. The breach affected 2,040 Washington residents, exposing names, addresses, usernames, passwords, and credit card data for a subset. Epik engaged forensic partners, secured services, and notified consumers by September 20, 2021.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d7 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 7 days

Sep 13, 2021

Begins

Sep 15, 2021

Discovered

Sep 22, 2021

Filed

vs. sector median

18 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_24a1025a0aa385972021-09-22Verified
Maine State AGbd_8580b47767c5ab332021-09-22Candidate
Massachusetts State AGbd_97ca2df622b2a7a62021-09-22Verified
New Hampshire State AGbd_b858195add59e72c2021-09-22Verified

Show 3 more filings ↓up to 2d gap

California State AGbd_04c8616c0dafed292021-09-20 · +2dVerified
Montana State AGbd_4997bb915de5559c2021-09-20 · +2dVerified
Indiana State AGbd_aca7cf9423a5c2cf2021-09-20 · +2dVerified

Name: Epik Holdings, Inc.
norm: epik holdings
Domain: epik.com

Name: Epik Holdings, Inc.
norm: epik holdings
Domain: epik.com
Industry: Technologyllm

Discovered: Sep 15, 2021
Breach occurred: Sep 13, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 20, 2021
Affected individuals: 2,040state-resident count only
Data types: Identity (basic)CredentialsFinancial account
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Washington Office of the Attorney General
Initial access: valid_credentials

During the incident: Retained multiple cybersecurity partners to investigate the incident
Secured access to its domain-side services
Applied additional security measures
Notified law enforcement and other relevant authorities
Provided Notice to Consumers to the affected individuals
Changes made: Offering free credit monitoring until September 15, 2023
Applied additional security measures to help protect services and users going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGSep 20 · first

Montana State AGSep 20 · first

Indiana State AGSep 20 · first

Oregon State AG+2d

Maine State AG+2d

Massachusetts State AG+2d

New Hampshire State AG+2d

Washington State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA2113.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2021
Raw hash: 5edf9dcb9ac0ad18d961c26378a5e101f2f36340cc1d931cc468ea77c633021c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityEpik Holdings, Inc.

Victim entityEpik Holdings, Inc.

Incidentdiscovered Sep 15, 2021

Stated responseRetained multiple cybersecurity partners to investigate the incident

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com