HackingRetail & ConsumerRetailBrute ForceCustomer Data InvolvedCredentialsLowContained

Zazzle Inc.

bd_f62ddf7f517f9181 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 1, 2017

Filed

Aug 25, 2017

To disclose

8 weeks

Affected

Not disclosed

Confidence

64%

All records for Zazzle Inc. →2 incidents on file

Account takeover notice

Zazzle Inc. notified customers of unauthorized attempts to access their accounts. The filing says: “What Information Was Involved: Given the nature of the incident, Zazzle believes that your username (email address) and password may have been obtained by an unauthorized third party, through a breach of other website(s), who then tried to confirm your credentials on our site.”

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 1, 2017 → Notified Aug 25, 201755d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

Jul 30, 2017

Begins

Aug 25, 2017

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Zazzle Inc.
norm: zazzle

Name: Zazzle Inc.
norm: zazzle
Industry: Retail & Consumerllm

Discovered: Jul 1, 2017
Access attempts: Jul 30, 2017
Materiality determined: —
Notification sent: Aug 25, 2017
Affected individuals: Not disclosed
Data types: Credentials
Attack vector: Unknown
MITRE ATT&CK: T1110 Brute Force
Threat actor: External
Initial access: valid_credentials

During the incident: Reset your password
Implemented a CAPTCHA on its website to prevent logins by automated means
Changes made: Evaluating additional safeguards and monitoring agents to deter these attacks going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: CA 60-day OK · 55d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 1, 2017
→ Notified: Aug 25, 2017
55d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 1, 2017 → Notified: Aug 25, 2017	55d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-101384
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2017
Raw hash: 6378efcf2041bad5c923e776d1c584178c3d8c9fbe62439e1a71fe0133fd5b5c

Reporting entityZazzle Inc.

Victim entityZazzle Inc.

Incidentdiscovered Jul 1, 2017

Stated responseReset your password

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov