HackingVulnerability ExploitTargetedData ExfiltratedFINANCIAL_ACCOUNTIDENTITY_BASICMediumResolved
California Massage Therapy Council
bd_9c5fa93deaaab850 · schema v1 · pii pii-v1
Full breach record for California Massage Therapy Council →California Massage Therapy Council reported a breach of its payment portal occurring on 11/04/2020, discovered on 07/27/2021. The incident potentially exposed payment data, including financial account numbers and credit/debit card numbers with security codes/PINs, affecting 7,290 individuals total, including 3 Maine residents. Written notification was sent on 08/26/2021.
Maine clockDiscovered Jul 27, 2021 → Filed with AG Sep 8, 202143d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_1e06efde36f08fc9California State AGfiled 2021-09-08Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/28b15d2c-54b6-4e0e-a20a-cf8a1e886433.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 8, 2021
- Raw hash
- 93f7f66cbb5f591be4617583ad4a3b34dac0183768329043e3dede54d2f39535
Reporting entity
- Name
- California Massage Therapy Councilnorm: california massage therapy council
- Domain
- camtccms.inlumon.com
Victim entity
- Name
- California Massage Therapy Councilnorm: california massage therapy council
- Domain
- camtccms.inlumon.com
Incident
- Discovered
- Jul 27, 2021
- Materiality determined
- —
- Notification sent
- Aug 26, 2021
- Affected individuals
- 7,290
- Data types
- FINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notification with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- ME AG >30d · 43d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 27, 2021→ Filed with AG: Sep 8, 202143d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.