MisuseInformationPrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDHighResolved

Rakuten USA, Inc.

bd_d667a4564196f04a · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 21, 2021

Filed

Feb 11, 2021

To disclose

21 days

Affected · nationwide

5,3901 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Rakuten USA, Inc. →

Rakuten USA, Inc. reported an insider wrongdoing incident that occurred and was discovered on January 21, 2021. The breach affected one Maine resident, whose name and Social Security number were compromised. The company notified the affected individual on February 11, 2021, and offered 24 months of complimentary credit monitoring services through Epiq.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 21, 2021 → Filed with AG Feb 11, 202121d ✓ ME AG ≤30d21 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 21 days

Jan 21, 2021

Begins

Jan 21, 2021

Discovered

Feb 11, 2021

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_3174790e2060a4d92021-02-11Verified
Massachusetts State AGbd_57c9021e9307b3f72021-02-11Verified
Montana State AGbd_5b9c71cefac703172021-02-11Candidate
New Hampshire State AGbd_3748bb1494a21cbc2021-02-18 · +7dVerified

Show 1 more filing ↓up to 7d gap

Indiana State AGbd_8175a8bc61f31f992021-02-04 · +7dVerified

Name: Rakuten USA, Inc.
norm: rakuten usa

Name: Rakuten USA, Inc.
norm: rakuten usa
Also named: Rakuten USA, Inc.dba oflegal entity
Rakuten Americasdba oftrade name

Discovered: Jan 21, 2021
Breach occurred: Jan 21, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2021
Affected individuals: 5,390state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Insider
Threat actor: Internal

Changes made: Offered 24 months of complimentary credit monitoring services through Epiq.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: ME AG ≤30d · 21d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 21, 2021
→ Filed with AG: Feb 11, 2021
21d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 21, 2021 → Filed with AG: Feb 11, 2021	21d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGFeb 4 · first

California State AG+7d

Massachusetts State AG+7d

Montana State AG+7d

Maine State AG+7d · this page

New Hampshire State AG+14d

Pattern: first filing Feb 4 (IN), last Feb 18 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5491feb7-523d-4bcd-a02c-2be1026a3da7.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 11, 2021
Raw hash: 77d3e8fd6e9274a0040a56ec8b575978dbc039c673847d57fc5e936fe7ade945

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityRakuten USA, Inc.

Victim entityRakuten USA, Inc.

Incidentdiscovered Jan 21, 2021

Stated responseOffered 24 months of complimentary credit monitoring services through Epiq.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov