HackingFinanceSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

Merchant One, Inc.

bd_e39d2ca718b31566 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2020

Filed

Nov 23, 2020

To disclose

39 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Merchant One, Inc. →

Merchant One, Inc. notified the California Attorney General of an incident where an unknown individual may have accessed specific files in its system via a third-party IT provider. The company became aware of suspicious activity on February 24, 2020. The potentially impacted data included personal information such as names and addresses. Merchant One engaged forensic specialists, confirmed system security, implemented enhanced email security, multi-factor authentication, and additional training, and transitioned to a different IT provider. Identity monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 24, 2020 → Notified Oct 26, 2020245d ✗ CA 60-day late39 weeks discovery → filing

Incident timeline

discovery → filing · 39 weeks / 273 days

Feb 24, 2020

Begins

Feb 24, 2020

Discovered

Nov 23, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0cd6828729bbce812020-11-23Verified
Massachusetts State AGbd_1410d50c584653da2020-11-23Verified
Maine State AGbd_6b85e9a03898bdae2020-11-23Candidate
New Hampshire State AGbd_feb24aac42208b292020-11-30 · +7dVerified

Name: Merchant One, Inc.
norm: merchant one

Name: Merchant One, Inc.
norm: merchant one

Discovered: Feb 24, 2020
Breach occurred: Feb 24, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 26, 2020
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via third-party IT provider
Initial access: supply_chain

During the incident: Immediately launched an investigation
Working with third-party forensic specialists to determine the full nature and scope of this incident
Began a comprehensive review of the files identified as potentially impacted
Worked with a vendor to assist with determining address information for impacted individuals
Took steps to confirm the security of our systems
Changes made: Implemented additional measures to further protect information, including enhanced email security
Implemented multi-factor authentication
Implemented additional training
Transitioned to utilizing a different IT provider
Arranged to have Kroll monitor your identity for one year at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(273 days from discovery to filing)
Compliance flags: CA 60-day late · 245d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 24, 2020
→ Notified: Oct 26, 2020
245d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 24, 2020 → Notified: Oct 26, 2020	245d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGNov 23 · first

Massachusetts State AGNov 23 · first

Maine State AGNov 23 · first

California State AGNov 23 · first · this page

New Hampshire State AG+7d

Pattern: first filing Nov 23 (IN), last Nov 30 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196442
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 23, 2020
Raw hash: 7b046085883ee078fd9156ead626ea2df74363e3371040333018eaae6cb6cee6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMerchant One, Inc.

Victim entityMerchant One, Inc.

Incidentdiscovered Feb 24, 2020

Stated responseImmediately launched an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov