Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Health (basic)Financial accountLowContained

Warby Parker

bd_8942611f8a369bd4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 30, 2018

Filed

Dec 20, 2018

To disclose

12 weeks

Affected

77state residents only

Linked

4 records

Confidence

65%

All records for Warby Parker →

Account takeover notice

Warby Parker notified customers of unauthorized access to their accounts. The filing says: “We began to investigate immediately, and so far we’ve determined that unauthorized parties may have obtained your username and password elsewhere—most likely through security breaches at other companies—and may have used this information to attempt to log in to your Warby Parker account.”

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 81 days

Sep 30, 2018

Begins

Sep 30, 2018

Discovered

Dec 20, 2018

Filed

vs. sector median

+2 wks slower

This filing is one of 4 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_93ff67dbc9f344b92018-12-20Verified
Oregon State AGbd_2bfbb470bd46e7c92018-12-27 · +7dVerified

Enforcement records (1)

HHS OCR enforcementbd_62d16c37bdd506f22025-02-20 · +2254dVerified by operator

Name: Warby Parker
norm: warby parker
Domain: warbyparkerfoundation.org

Name: Warby Parker
norm: warby parker
Domain: warbyparkerfoundation.org
Industry: Retail & Consumerllm

Discovered: Sep 30, 2018
Account access: Sep 30, 2018 – Nov 30, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 21, 2018
Affected individuals: 77state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Reported this matter to law enforcement
Initial access: phishing_link

During the incident: Engaged third-party cybersecurity experts to help
Continue to monitor site traffic closely
Reported this matter to law enforcement and are actively cooperating with them
Required all potentially affected customers to reset their passwords
Changes made: Working to try to prevent this kind of event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRDec 20 · first

Montana State AGDec 20 · first · this page

Oregon State AG+7d

Pattern: first filing Dec 20 (NY), last Dec 27 (OR) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/JAND-Inc.-Warby-Parker.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2018
Raw hash: 495408754ff251e259a69b3c24e4b91210ab17ce410e32458bc0ebb2c96c206d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Enforcement records (1)

Reporting entityWarby Parker

Victim entityWarby Parker

Incidentdiscovered Sep 30, 2018

Stated responseEngaged third-party cybersecurity experts to help

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov