HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Apro, LLC

bd_e2ae2834649e791a · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 22, 2025

Filed

Dec 29, 2025

To disclose

40 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for Apro, LLC →3 incidents on file

Apro, LLC d/b/a United Pacific disclosed that an unauthorized third party accessed certain systems between February 19, 2025, and March 2, 2025, and obtained files containing personal information, including names. The incident was discovered on March 22, 2025. The company engaged cybersecurity firms, notified law enforcement, and is offering identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 22, 2025 → Notified Dec 29, 2025282d ✗ CA 60-day late40 weeks discovery → filing

Incident timeline

undetected · 31 days

discovery → filing · 40 weeks / 282 days

Feb 19, 2025

Begins

Mar 22, 2025

Discovered

Dec 29, 2025

Filed

vs. sector median

+33 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Nebraska State AGbd_012484720eafaaa92025-12-29Verified
Oregon State AGbd_16389e96311185da2025-12-29Candidate
California State AGbd_5a2af9e1606bffab2025-12-29Verified
Massachusetts State AGbd_68418fa12605f1862025-12-29Verified

Show 6 more filings ↓

Washington State AGbd_92a219fd595ad40f2025-12-29Verified
Washington State AGbd_9b890dc299bb37f82025-12-29Verified
Maine State AGbd_a14649851a366e8c2025-12-29Verified
Indiana State AGbd_bc689181dec5de1d2025-12-29Candidate
Indiana State AGbd_c87591ff1ff51cdd2025-12-29Verified
Nebraska State AGbd_cb4ed0be09dddd5f2025-12-29Verified

Name: Apro, LLC
norm: apro

Name: Apro, LLC
norm: apro
Also named: Apro, LLCdba oflegal entity
United Pacific (Apro)dba oftrade name
Industry: Retail & Consumerllm

Discovered: Mar 22, 2025
Breach occurred: Feb 19, 2025 – Mar 2, 2025
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Launched an investigation
Engaged leading cybersecurity firms to assist
Notified law enforcement
Launched a review of the files involved to identify individuals whose personal information may have been contained in the files
Changes made: Implemented additional measures to further enhance the security of its systems and data
Offering a complimentary 12/24-month membership of Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(282 days from discovery to filing)
Compliance flags: CA 60-day late · 282d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 22, 2025
→ Notified: Dec 29, 2025
282d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 22, 2025 → Notified: Dec 29, 2025	282d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Nebraska State AGDec 29 · first

Oregon State AGDec 29 · first

California State AGDec 29 · first

Massachusetts State AGDec 29 · first

Washington State AGDec 29 · first

Maine State AGDec 29 · first

Indiana State AGDec 29 · first

Nebraska State AGDec 29 · first

California State AGDec 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-616356
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2025
Raw hash: af01358cdc3f103acfad39713a8411f185d7a83139bd96d91687b60899e61be4

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityApro, LLC

Victim entityApro, LLC

Incidentdiscovered Mar 22, 2025

Stated responseLaunched an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov