MalwareRetail & ConsumerRetailCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPCIFinancial accountFinancial credentialsIdentity (basic)MediumContained

LÍLLÉbaby

bd_f92a306617ed7da4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2018

Filed

Aug 29, 2018

To disclose

13 weeks

Affected

4,068state residents only

Linked

5 filings

Confidence

66%

Full breach record for LÍLLÉbaby →

LÍLLÉbaby reported a data security incident involving unauthorized malware installation on its e-commerce platform. The malware potentially compromised payment card information (names, card numbers, expiration dates, security codes) for customers who made purchases between June 2016 and July 9, 2018. The company discovered the incident in June 2018. 4,068 California residents were affected. LÍLLÉbaby engaged a forensics firm, removed the malware, reported to the FBI and payment card brands, and is rebuilding its web platform with enhanced security. Identity monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2018 → Notified Aug 28, 201888d ✗ CA 60-day late13 weeks discovery → filing

Incident timeline

undetected · 730 days

discovery → filing · 13 weeks / 89 days

Jun 1, 2016

Begins

Jun 1, 2018

Discovered

Aug 29, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_42f139649d2cf0362018-08-29Verified
Oregon State AGbd_e6bf067828ae30522018-08-29Candidate
New Hampshire State AGbd_ec62da6a823fbd402018-08-29Verified
Washington State AGbd_f000fce9dfaaaa232018-08-29Verified

Name: LÍLLÉbaby
norm: lillebaby
Domain: lillebaby.com

Name: LÍLLÉbaby
norm: lillebaby
Domain: lillebaby.com
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Jun 1, 2016 – Jul 9, 2018
Undetected for: 730 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2018
Affected individuals: 4,068state-resident count only
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the matter to the Federal Bureau of Investigation (“FBI”)Reported the matter to the payment card brands
Initial access: exploit_public_facing

During the incident: Took immediate steps to secure payment card information belonging to LÍLLÉbaby customers
Launched an investigation and retained a leading forensics firm to determine what happened and whether customer payment card information had been accessed or acquired without authorization
Reported the matter to the Federal Bureau of Investigation (“FBI”)
Reported the matter to the payment card brands in order to help protect customer payment card information and to help prevent fraudulent activity
Working with a leading forensics firm to remove malicious code from the LÍLLÉbaby e-commerce web platform
Changes made: Taken steps to increase the security of its e-commerce platform (Magento)
Transitioned to processing payment cards through Payflow Pro IFrame to bolster transaction security
In the process of rebuilding its web platform in order to enhance the security of its payment card environment
Offering identity monitoring services for twelve (12) months at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: CA 60-day late · 88d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2018
→ Notified: Aug 28, 2018
88d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2018 → Notified: Aug 28, 2018	88d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 29 · first

Oregon State AGAug 29 · first

New Hampshire State AGAug 29 · first

Washington State AGAug 29 · first

California State AGAug 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-139381
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2018
Raw hash: 1d59f027d1fa5fea0eb1757ba8000dd3c44cc86e9978e52f54136f1ea23bf786

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLÍLLÉbaby

Victim entityLÍLLÉbaby

Incidentdiscovered Jun 1, 2018

Stated responseTook immediate steps to secure payment card information belonging to LÍLLÉbaby customers

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov