HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedTargetedIdentity (basic)Government IDHighActive

Garden of Life, LLC

bd_f032b1f7c39531fa · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 11, 2025

Filed

Dec 12, 2025

To disclose

28 days

Affected · nationwide

2,2851 in this filing

Linked

8 filings

Confidence

65%

Full breach record for Garden of Life, LLC →2 incidents on file

Garden of Life, LLC reported an external system breach where an unauthorized third party exploited a previously unknown vulnerability in Oracle E-Business Suite to access data between August 9-10, 2025. The incident was discovered on November 14, 2025, affecting 2,285 individuals (including 1 Maine resident). Compromised data included names, addresses, emails, phone numbers, and SSNs. Garden of Life is offering 24 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 11, 2025 → Filed with AG Dec 12, 202531d ⏱ ME AG >30d28 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 94 days

discovery → filing · 4 weeks / 31 days

Aug 9, 2025

Begins

Nov 11, 2025

Discovered

Dec 12, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_ec4c9437f690de472025-11-13 · +28dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_174932bce476c8872025-12-12Verified by operator
New Hampshire State AGbd_526e3fb4468ed0922025-12-12Verified
Montana State AGbd_836251fccf324aec2025-12-12Verified
Indiana State AGbd_01940a2f5f3090762025-12-04 · +8dVerified

Show 2 more filings ↓up to 38d gap

Nebraska State AGbd_ad8c0255642bf7962025-12-04 · +8dVerified
Vermont State AGbd_ef65a6f54dd21f0e2025-11-04 · +38dVerified

Name: Garden of Life, LLC
norm: garden of life
Domain: gardenoflife.com

Name: Garden of Life, LLC
norm: garden of life
Domain: gardenoflife.com
Industry: Retail & Consumerllm

Discovered: Nov 11, 2025
Breach occurred: Aug 9, 2025 – Aug 10, 2025
Undetected for: 94 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2025
Affected individuals: 2,285state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Taking potentially affected systems offline
Initiating an investigation by internal and external experts
Applied the relevant Oracle patches upon their release
Secured the affected systems
Offering identity theft protection services through IDX
Changes made: Applied the relevant Oracle patches upon their release
Secured the affected systems
Considering additional security measures to help prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: ME AG >30d · 31d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 11, 2025
→ Filed with AG: Dec 12, 2025
31d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 11, 2025 → Filed with AG: Dec 12, 2025	31d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGNov 4 · first

Indiana State AG+30d

Nebraska State AG+30d

Massachusetts State AG+38d

New Hampshire State AG+38d

Montana State AG+38d

Maine State AG+38d · this page

Pattern: first filing Nov 4 (VT), last Dec 12 (ME) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2d306479-36be-41e2-99f8-b736d41db021.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2025
Raw hash: 7b68e8045092d69d9310b318212b539587fa8cee6b04d8f1e5c36fb00824fc58

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityGarden of Life, LLC

Victim entityGarden of Life, LLC

Incidentdiscovered Nov 11, 2025

Stated responseTaking potentially affected systems offline

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov