Social EngineeringRetail & ConsumerRetailPhishingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsBehaviorLowContained

Bodybuilding.com, LLC

bd_fb96d8d61123e016 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2019

Filed

Jun 24, 2019

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Bodybuilding.com, LLC →

Bodybuilding.com (a subsidiary of Vitalize LLC) notified customers of a data breach involving unauthorized access to systems. The incident originated from a phishing email in July 2018, discovered in February 2019. Potentially accessed data included names, emails, passwords, and billing addresses. No full credit card numbers were stored. The company engaged forensic consultants, reset passwords, and coordinated with law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 215 days

discovery → filing · 20 weeks / 143 days

Jul 1, 2018

Begins

Feb 1, 2019

Discovered

Jun 24, 2019

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_1368bb2e24bf74802019-04-19 · +66dVerified
HHS OCRbd_88f7f8ae652d19602019-04-19 · +66dVerified

Name: Bodybuilding.com, LLC
norm: bodybuildingcom
Domain: bodybuilding.com

Name: Bodybuilding.com, LLC
norm: bodybuildingcom
Domain: bodybuilding.com
Industry: Retail & Consumerllm

Discovered: Feb 1, 2019
Breach occurred: Jul 1, 2018
Undetected for: 215 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2019
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: coordinating with law enforcement to investigate the incident
Initial access: phishing_link

During the incident: Engaged one of the leading data security firms to conduct a thorough investigation
Brought in external forensic consultants that specialize in cyber attacks
Working with leading security experts to address any vulnerabilities and remediate the incident
Continue to monitor our systems for unauthorized access
Introduced additional security measures
Will be resetting Bodybuilding.com customers’ passwords on their next log-in
Coordinating with law enforcement to investigate the incident
Changes made: Introduced additional security measures
Resetting Bodybuilding.com customers’ passwords on their next log-in
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGApr 19 · first

HHS OCRApr 19 · first

Delaware State AG+66d · this page

Pattern: first filing Apr 19 (CA), last Jun 24 (DE) — a 66-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2019/06/Vitalize-LLC-Customer-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2019
Raw hash: ffa75a5551d6568317a7689074a69ae61ae895ceda6ceed26ee3c2d0202226c5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBodybuilding.com, LLC

Victim entityBodybuilding.com, LLC

Incidentdiscovered Feb 1, 2019

Stated responseEngaged one of the leading data security firms to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov