HackingIdentity (basic)Government IDCredentialsMediumContained

OBAGI COSMECEUTICALS LLC

bd_b14d031182fa7803 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 19, 2025

Filed

May 12, 2026

To disclose

—

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for OBAGI COSMECEUTICALS LLC →

Obagi Cosmeceuticals LLC reported a cybersecurity incident to the Nebraska Attorney General. On August 19, 2025, Obagi detected unauthorized access to its network. The investigation confirmed that an unauthorized actor accessed files containing names, Social Security numbers, driver's license numbers, and online account credentials. Obagi notified one Nebraska resident on May 12, 2026, and provided 12 months of complimentary credit monitoring through Experian. Obagi implemented additional safeguards and employee training.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 19, 2025

Begins

Aug 19, 2025

Discovered

May 12, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_0fd0d884908c74552026-05-12Verified
Indiana State AGbd_2b06390d6f3897f82026-05-12Candidate
Massachusetts State AGbd_aade961adc809a372026-05-12Verified

Name: OBAGI COSMECEUTICALS LLC
norm: obagi cosmeceuticals

Name: OBAGI COSMECEUTICALS LLC
norm: obagi cosmeceuticals

Discovered: Aug 19, 2025
Breach occurred: Aug 19, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took steps to secure its network
Initiated a comprehensive investigation to determine the nature and scope of the event with the assistance of third-party cybersecurity and digital forensic specialists
Conducted a time-intensive review of the files to identify sensitive information contained therein and to whom the information relates
Undertook efforts to further locate address information for impacted individuals
Providing access to credit monitoring services for twelve (12) months, through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGMay 12 · first

Indiana State AGMay 12 · first

Massachusetts State AGMay 12 · first

Nebraska State AGMay 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/35b40311-6e23-4dd6-abb7-44ec64292704.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2026
Raw hash: c7aa47ddc6b83e0a0768b430d5c91cfc803e54f77b82115bdf5ea33c4511357c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOBAGI COSMECEUTICALS LLC

Victim entityOBAGI COSMECEUTICALS LLC

Incidentdiscovered Aug 19, 2025

Stated responseTook steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov