HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataTargetedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Julep Beauty

bd_e44398de84097367 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 7, 2018

To disclose

—

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for Julep Beauty →2 incidents on file

Julep Beauty, Inc. notified Montana residents that an unauthorized user injected code into its website between Oct 12-16, 2018, redirecting payment info. Compromised data included names, addresses, credit card numbers, and security codes for new card users. Julep removed the code and secured the server. Notices sent Nov 7, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 12, 2018

Begins

Nov 7, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8b82c87aec384f7c2018-11-08 · +1dVerified
New Hampshire State AGbd_dd3eae54268c5e132018-11-13 · +6dVerified

Name: Julep Beauty
norm: julep beauty

Name: Julep Beauty
norm: julep beauty
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Oct 12, 2018 – Oct 16, 2018
Materiality determined: —
Notification sent: Nov 7, 2018
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code from the webpage
Ensured the unauthorized third party is not able to access the server
Changes made: Examining ways to better protect data
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 7 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+6d

Pattern: first filing Nov 7 (MT), last Nov 13 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Julep-Beauty.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2018
Raw hash: 2933414eff2f004ed37b18a9a82b11ed22fa816198c8037e18321a8e7609f1bc

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityJulep Beauty

Victim entityJulep Beauty

IncidentUnauthorized Access

Stated responseRemoved the unauthorized code from the webpage

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov