HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

Garden of Life, LLC

bd_ad8c0255642bf796 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 11, 2025

Filed

Dec 4, 2025

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Full breach record for Garden of Life, LLC →2 incidents on file

Garden of Life, LLC notified Nebraska AG of a data breach involving an unauthorized third party exploiting a previously unreported vulnerability in Oracle E-Business Suite. Access occurred August 9-10, 2025; discovered November 11, 2025. Data included names, addresses, emails, phone numbers, and SSNs of employees, contractors, and business partners. Remediation included patching, system security, and offering IDX identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 94 days

Aug 9, 2025

Begins

Nov 11, 2025

Discovered

Dec 4, 2025

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_ec4c9437f690de472025-11-13 · +20dVerified by operator

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_01940a2f5f3090762025-12-04Verified
Massachusetts State AGbd_174932bce476c8872025-12-12 · +8dVerified by operator
New Hampshire State AGbd_526e3fb4468ed0922025-12-12 · +8dVerified
Montana State AGbd_836251fccf324aec2025-12-12 · +8dVerified

Show 2 more filings ↓up to 30d gap

Maine State AGbd_f032b1f7c39531fa2025-12-12 · +8dCandidate
Vermont State AGbd_ef65a6f54dd21f0e2025-11-04 · +30dVerified

Name: Garden of Life, LLC
norm: garden of life
Domain: gardenoflife.com

Name: Garden of Life, LLC
norm: garden of life
Domain: gardenoflife.com
Industry: Retail & Consumerllm

Discovered: Nov 11, 2025
Breach occurred: Aug 9, 2025 – Aug 10, 2025
Undetected for: 94 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Taking potentially affected systems offline
Initiating an investigation by internal and external experts
Applied the relevant Oracle patches upon their release and secured the affected systems
Offering identity theft protection services through IDX
Changes made: Applied the relevant Oracle patches upon their release
Secured the affected systems
Considering additional security measures to help prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGNov 4 · first

Indiana State AG+30d

Nebraska State AG+30d · this page

Massachusetts State AG+38d

New Hampshire State AG+38d

Montana State AG+38d

Maine State AG+38d

Pattern: first filing Nov 4 (VT), last Dec 12 (ME) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/50e324fa-9cef-48ef-a0bd-fab6fc9685a8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2025
Raw hash: 508186917084ee415a46368c9c5fba0fc1068a3c4fc7c087ea58c6814c0edbf7

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityGarden of Life, LLC

Victim entityGarden of Life, LLC

Incidentdiscovered Nov 11, 2025

Stated responseTaking potentially affected systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov