AccidentalRetail & ConsumerRetailProgramming ErrorCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowResolved

Zulily, Inc.

bd_ec59f3b17c8c3fe9 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 22, 2022

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Zulily, Inc. →

Zulily, LLC disclosed a data breach caused by a coding error on its website checkout page. Between February 23, 2022, and June 15, 2022, transaction information for some customers was inadvertently sent to an unauthorized second payment card processor. The exposed data included email addresses, payment card numbers, card verification codes, and expiration dates. Zulily corrected the code, notified the processors, and is issuing refunds for duplicate shipping and handling charges. No malicious actor was involved; this was an internal error.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 23, 2022

Begins

Jul 22, 2022

Filed

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_3c2a0b3c2997f9b52022-07-22Candidate
Montana State AGbd_430b9bf43cf0ad632022-07-22Verified by operator
Indiana State AGbd_70a151ad6b5eea7a2022-07-22Verified
Oregon State AGbd_d4316952ca18512e2022-07-22Verified

Show 1 more filing ↓

Massachusetts State AGbd_dfe6b17bfd4229d92022-07-22Verified

Name: Zulily, Inc.
norm: zulily

Name: Zulily, Inc.
norm: zulily
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Feb 23, 2022 – Jun 15, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Misconfiguration

During the incident: Corrected the issue with the code operating the checkout page
Notified the payment processors
Processing a refund for those customers who were charged more than once for shipping and handling
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGJul 22 · first

Montana State AGJul 22 · first

Indiana State AGJul 22 · first

Oregon State AGJul 22 · first

Massachusetts State AGJul 22 · first

California State AGJul 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-555541
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2022
Raw hash: 1958bfbc2838d1e42bf7c3f67a5be03acc61632b9a7e3379de7cc123927f509a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityZulily, Inc.

Victim entityZulily, Inc.

IncidentMisconfiguration

Stated responseCorrected the issue with the code operating the checkout page

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov