DisclosureLens
UnknownRetailMedium

Totally Promotional

bd_7ee71c6bd4ebf587 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 13, 2024

Filed

Oct 16, 2024

To disclose

5 weeks

Affected

39,024

Linked

12 filings

Confidence

95%
Full breach record for Totally Promotional →3 incidents on file

Totally Promotional reported a data breach to the Oregon Attorney General. The breach was reported on 2024-10-16. The breach occurred during 11/20/2023 - 7/11/2024. The breach was discovered on 9/13/2024. 39,024 individuals were affected. Notice was sent on 10/16/2024.

Date basis clock✓ Clock withheld · confirmation date5 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 298 days
discovery → filing · 5 weeks / 33 days

Nov 20, 2023

Begins

Sep 13, 2024

Discovered

Oct 16, 2024

Filed

This filing is one of 12 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 40d gap

Showing first 10 of 11 linked disclosures.

Filing propagation · 11 filings · 10 states

View merged incident ↗
New Hampshire State AGOct 16 · first
California State AGOct 16 · first
Vermont State AGOct 16 · first
Washington State AGOct 16 · first
Maine State AGOct 16 · first
Montana State AGOct 16 · first
Indiana State AGOct 16 · first
Massachusetts State AGOct 16 · first
Oregon State AGOct 16 · first · this page
South Carolina State AG+1d
California State AG+40d

Pattern: first filing Oct 16 (NH), last Nov 25 (CA) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.