HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataTargetedData ExfiltratedPIIPCIIdentity (basic)Financial accountFinancial credentialsLowContained

NutriBullet, LLC

bd_b8dcf7e710dd232b · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 17, 2020

Filed

Apr 29, 2020

To disclose

6 weeks

Affected

8state residents only

Linked

3 filings

Confidence

66%

NutriBullet, LLC notified customers of a security incident where an unauthorized user modified the checkout page of www.nutribullet.com to collect customer information, including names, addresses, and payment card details (number, expiration, CVV). The incident affected orders placed between February 19, 2020, and March 17, 2020. NutriBullet engaged forensic investigators and enhanced website security.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 6 weeks / 43 days

Feb 19, 2020

Begins

Mar 17, 2020

Discovered

Apr 29, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_90123d9a7c1415e82020-04-29Verified
New Hampshire State AGbd_a34a1cc7ae236f852020-04-30 · +1dVerified

Name: NutriBullet, LLC
norm: nutribullet
Domain: nutribullet.com

Name: NutriBullet, LLC
norm: nutribullet
Domain: nutribullet.com
Industry: Retail & Consumerllm

Discovered: Mar 17, 2020
Breach occurred: Feb 19, 2020 – Mar 17, 2020
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: PIIPCIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Corrected the unauthorized access
Engaged a digital threat management company to provide additional monitoring of the site
Began an investigation with the assistance of a leading computer security firm
Enhanced the security measures for our website
Working with the payment card networks to notify banks that issue payment cards
Changes made: Enhanced the security measures for our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 29 · first

Montana State AGApr 29 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-80.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2020
Raw hash: 20ec68b850e63fb07e3a811fd8e1e6834f742f26e2c5e860546b875d629ead40

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNutriBullet, LLC

Victim entityNutriBullet, LLC

Incidentdiscovered Mar 17, 2020

Stated responseCorrected the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov