HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHighContained
JAND Inc.
bd_b170633faba40bb9 · schema v1 · pii pii-v1
Full breach record for JAND Inc. →JAND Inc. d/b/a Warby Parker reported a data security incident in California affecting approximately 30,170 customers. Unauthorized parties used stolen credentials from other breaches to attempt login to Warby Parker accounts between September 25 and November 30, 2018. While no proof of actual data theft was found, potentially accessed data included names, emails, prescription info, and partial payment card digits. Warby Parker required password resets and engaged forensic experts.
California clockDiscovered Nov 26, 2018 → Notified Dec 20, 201824d ✓ CA 60-day OK25 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed30,170 affectedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-143124
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 21, 2018
- Raw hash
- 0033ccc7ebb1fb2460a92d0beef5e4fb35654e8a911fe6330a198c8e77532306
Reporting entity
- Name
- JAND Inc.norm: jand
- Domain
- warbyparker.com
Victim entity
- Name
- JAND Inc.norm: jand
- Domain
- warbyparker.com
Incident
- Discovered
- Nov 26, 2018
- Materiality determined
- —
- Notification sent
- Dec 20, 2018
- Affected individuals
- 30,170
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified California Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 25 days(25 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 24d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Nov 26, 2018→ Notified: Dec 20, 201824d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.