HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountLowContained

Etison LLC

bd_82efd3097567de7d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 24, 2024

Filed

Jul 30, 2024

To disclose

6 days

Affected · nationwide

8862 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Etison LLC →

Etison LLC dba ClickFunnels reported a data breach where an unauthorized individual gained access to a third-party contractor's login credentials. The actor injected custom code into a checkout page footer between July 21 and July 24, 2024. The incident affected 886 individuals, including 2 Maine residents, exposing names, contact info, and credit card data. ClickFunnels disabled the account and implemented additional security measures.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 24, 2024 → Filed with AG Jul 30, 20246d ✓ ME AG ≤30d6 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 6 days

Jul 21, 2024

Begins

Jul 24, 2024

Discovered

Jul 30, 2024

Filed

vs. sector median

10 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_218275894307fc092024-08-01 · +2dVerified
Vermont State AGbd_69f863257039f55d2024-08-01 · +2dVerified
Montana State AGbd_90feb67bf31410cf2024-08-01 · +2dCandidate

Name: Etison LLC
norm: etison
Domain: clickfunnels.com

Name: Etison LLC
norm: etison
Domain: clickfunnels.com
Also named: Etison LLCdba oflegal entity
ClickFunnelsdba oftrade name
Industry: Technologyllm

Discovered: Jul 24, 2024
Breach occurred: Jul 21, 2024 – Jul 24, 2024
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2024
Affected individuals: 886state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: valid_credentials

During the incident: Activated Incident Response Plan
Audited internal records and logs
Removed the custom script
Disabled the compromised contractor’s account
Implemented additional security measures for authorized individuals
Changes made: Implemented additional security measures for authorized individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: ME AG ≤30d · 6d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 24, 2024
→ Filed with AG: Jul 30, 2024
6d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 24, 2024 → Filed with AG: Jul 30, 2024	6d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJul 30 · first · this page

Indiana State AG+2d

Vermont State AG+2d

Montana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3b2aa9be-1d26-441a-8666-b665f89ca2af.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2024
Raw hash: 2ebc8948f1e25e7d5f4f9bf1ab1241efc4aee9851aa5a9357d134876a049cb5a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEtison LLC

Victim entityEtison LLC

Incidentdiscovered Jul 24, 2024

Stated responseActivated Incident Response Plan

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov