Dollar Shave Club, Inc.
bd_ebdfc1c9e7488eb5 · schema v1 · pii pii-v1
All records for Dollar Shave Club, Inc. →2 incidents on fileAccount takeover notice
Dollar Shave Club, Inc. notified customers of unauthorized access to their accounts. The filing says: “As noted, this incident involved the email address and password combinations (obtained through some other source, not Dollar Shave Club) that were then used to access your Dollar Shave Club online account, which allows someone to view the information in your account, including your name, address, and the last four digits of your payment card on file (if you’ve provided that information).”
On March 21, 2018, Dollar Shave Club identified unauthorized login attempts using credentials obtained from other sources (credential stuffing). The attacker used valid email/password combinations to access customer accounts. Dollar Shave Club blocked suspicious IPs, reset passwords for affected accounts, and limited login attempts. Affected data included names, addresses, and the last four digits of payment cards. No full payment card data or other financial information was compromised.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 21, 2018
Begins
Mar 21, 2018
Discovered
Apr 4, 2018
Filed
vs. sector median
8 wks faster
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.