HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Julep Beauty

bd_dd3eae54268c5e13 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 7, 2018

Filed

Nov 13, 2018

To disclose

6 days

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Julep Beauty →2 incidents on file

Julep Beauty, Inc. notified the NH AG of a data breach affecting 2 NH residents. Unauthorized code injected into the website between Oct 12-16, 2018, compromised customer names, addresses, and credit card details. Julep removed the code and notified affected individuals on Nov 7, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 26 days

discovery → filing · 6 days

Oct 12, 2018

Begins

Nov 7, 2018

Discovered

Nov 13, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8b82c87aec384f7c2018-11-08 · +5dVerified
Montana State AGbd_e44398de840973672018-11-07 · +6dCandidate

Name: Julep Beauty
norm: julep beauty

Name: Julep Beauty
norm: julep beauty
Industry: Retail & Consumerllm

Discovered: Nov 7, 2018
Breach occurred: Oct 12, 2018 – Oct 16, 2018
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data StagedT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code from the webpage
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 7 · first

Massachusetts State AG+1d

New Hampshire State AG+6d · this page

Pattern: first filing Nov 7 (MT), last Nov 13 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/julep-beauty-20181113.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2018
Raw hash: 42075efae329fac146ae7886457b78fd53c6bc27830ce082716572bbb208f3c1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityJulep Beauty

Victim entityJulep Beauty

Incidentdiscovered Nov 7, 2018

Stated responseRemoved the unauthorized code from the webpage

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov