HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHighContained

DOTERRA INTERNATIONAL, LLC

bd_b620c205f026aa44 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Apr 18, 2016

To disclose

—

Affected

18,304state residents only

Linked

8 filings

Confidence

66%

Full breach record for DOTERRA INTERNATIONAL, LLC →

doTERRA International, LLC notified Montana residents that a third-party vendor's systems were accessed in March 2016, resulting in the unauthorized acquisition of personal information including names, SSNs, payment card data, and credentials. doTERRA engaged law enforcement and security experts, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 1, 2016

Begins

Apr 18, 2016

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_2143531664cf479b2016-04-18Verified
New Hampshire State AGbd_6a3e063adb2d639d2016-04-18Verified
Washington State AGbd_9a87e92b0eb4f9a12016-04-18Candidate
Massachusetts State AGbd_e8aee4e3ea940ead2016-04-18Verified

Show 3 more filings ↓up to 24d gap

Oregon State AGbd_fbb6cfe862b6c98e2016-05-02 · +14dVerified
Hawaii State AGbd_9c78fc895e9a66872016-05-11 · +23dVerified
South Carolina State AGbd_05a513dc0989d7562016-05-12 · +24dVerified

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international

Name: DOTERRA INTERNATIONAL, LLC
norm: doterra international
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Mar 1, 2016 – Mar 31, 2016
Materiality determined: —
Notification sent: Apr 18, 2016
Affected individuals: 18,304state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Working closely with law enforcement authorities
Engaged leading security experts
Offering identity protection and credit monitoring services for 24 months at no cost
Changes made: Investing heavily to implement state-of-the-art systems to support growth and expansion and enhance security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGApr 18 · first

New Hampshire State AGApr 18 · first

Washington State AGApr 18 · first

Massachusetts State AGApr 18 · first

Montana State AGApr 18 · first · this page

Oregon State AG+14d

Hawaii State AG+23d

South Carolina State AG+24d

Pattern: first filing Apr 18 (CA), last May 12 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/doTerra-International.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2016
Raw hash: 17b4843d8dcac8bfae6dd2e5a7d5cbf6a7574a26d00bb31a0a430c0cdcdfde63

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDOTERRA INTERNATIONAL, LLC

Victim entityDOTERRA INTERNATIONAL, LLC

IncidentThird-Party / Supply Chain

Stated responseWorking closely with law enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov