MalwareRansomwareData ExfiltratedCustomer Data InvolvedMulti-Stage ChainPCIFINANCIAL_ACCOUNTMediumContained
LÍLLÉbaby
bd_f92a306617ed7da4 · schema v1 · pii pii-v1
Full breach record for LÍLLÉbaby →LÍLLÉbaby notified the California AG of a data security incident involving unauthorized malware installation on its e-commerce platform. The breach affected payment card information (names, numbers, expiration, security codes) for 4,068 California residents from June 2016 to July 2018. LÍLLÉbaby engaged forensic investigators, reported to the FBI and payment brands, and offered 12 months of identity monitoring.
California clockDiscovered Jun 1, 2018 → Notified Aug 28, 201888d ✗ CA 60-day late13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,068 affectedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-139381
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 29, 2018
- Raw hash
- 1d59f027d1fa5fea0eb1757ba8000dd3c44cc86e9978e52f54136f1ea23bf786
Reporting entity
- Name
- LÍLLÉbabynorm: lillebaby
- Domain
- lillebaby.com
Victim entity
- Name
- LÍLLÉbabynorm: lillebaby
- Domain
- lillebaby.com
Incident
- Discovered
- Jun 1, 2018
- Materiality determined
- Aug 29, 2018
- Notification sent
- Aug 28, 2018
- Affected individuals
- 4,068
- Data types
- PCIFINANCIAL_ACCOUNT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- Submitted notification to California Attorney General Xavier Becerra
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 weeks(89 days from discovery to filing)
- Compliance flags
- CA 60-day late · 88d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 1, 2018→ Notified: Aug 28, 201888d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.