HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Lucky Health Group

bd_b3b81f7934f2421d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

Jun 21, 2021

To disclose

13 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Lucky Health Group →

Lucky Health Group, Inc. d/b/a Lucky Vitamin notified the NH AG of a data event affecting 2 NH residents. Unauthorized access occurred between March 16-19, 2021, when an unknown actor removed files. Discovered March 19, 2021. Data included names and SSNs. Notification sent June 17, 2021. Response included forensic investigation, law enforcement notification, and 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 13 weeks / 94 days

Mar 16, 2021

Begins

Mar 19, 2021

Discovered

Jun 21, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_007653b31e8a2e8a2021-06-17 · +4dCandidate
Indiana State AGbd_142850d25680a4ff2021-06-17 · +4dVerified
Massachusetts State AGbd_8cf33e7b2b6d566d2021-06-17 · +4dVerified

Name: Lucky Health Group
norm: lucky health
Domain: luckyvitamin.com

Name: Lucky Health Group
norm: lucky health
Domain: luckyvitamin.com
Also named: Lucky Health Group, Inc.dba oflegal entity
Lucky Vitamindba oftrade name
Industry: Retail & Consumerllm

Discovered: Mar 19, 2021
Breach occurred: Mar 16, 2021 – Mar 19, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 17, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party computer forensic specialists
Notified federal law enforcement
Implemented additional technical security measures on relevant systems
Providing access to credit monitoring and identity restoration services for twelve (12) months, through Experian
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 17 · first

Indiana State AGJun 17 · first

Massachusetts State AGJun 17 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lucky-health-group-dba-lucky-vitamin-20210621.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2021
Raw hash: 46ac24b5baf9afdb66ff4327c80fbef2590396f2b35d8fed25c4487133fbcb87

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityLucky Health Group

Victim entityLucky Health Group

Incidentdiscovered Mar 19, 2021

Stated responseLaunched an investigation with the assistance of third-party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov