HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTHighContained
Bosley, Inc.
bd_ee7b1b68b5b8c398 · schema v1 · pii pii-v1
Full breach record for Bosley, Inc. →Bosley, Inc. reported an external system breach (hacking) occurring on August 17, 2020, discovered on January 10, 2020. The incident affected 100,855 individuals, including 158 Maine residents. Acquired data included names and financial account or credit/debit card numbers (with security codes/PINs). Bosley provided written notification on January 16, 2021, and offered 12 months of credit monitoring and identity theft restoration services via TransUnion.
Maine clockDiscovered Jan 10, 2020 → Filed with AG Jan 26, 2021382d ✗ ME AG >90d13 months discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cae0e046-07c6-4e73-b45e-63126a5fafe6.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 26, 2021
- Raw hash
- 0637015791c41b163ea30385a89a50ed3ad08553da794d3e029fc9f2dd10e60a
Reporting entity
- Name
- Bosley, Inc.norm: bosley
- Domain
- bosley.com
Victim entity
- Name
- Bosley, Inc.norm: bosley
- Domain
- bosley.com
Incident
- Discovered
- Jan 10, 2020
- Materiality determined
- —
- Notification sent
- Jan 16, 2021
- Affected individuals
- 100,855
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 months(382 days from discovery to filing)
- Compliance flags
- ME AG >90d · 382dME resident >180d · 372d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 10, 2020→ Filed with AG: Jan 26, 2021382d 90 days ME AG >90d Maine Discovered: Jan 10, 2020→ Notified: Jan 16, 2021372d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.