The LoveSac Company

ent_769a861ceed7a03d

Compliance scorecard →View in feed →

Disclosures

State AG · Leak Site · 7 jurisdictions

Multi-filing incidents

incidents joining 2+ filings here

Max affected reported

2,299

nationwide · State AG IN

Leak-site claims

unverified actor claims

Identity resolution

Canonical name: The LoveSac Company
Normalized: the lovesac— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: No match
SEC EDGAR CIK: None — not an SEC registrant
Domain: lovesac.com

Disclosure history (14)newest first

Massachusetts State AGas victim2025-09-05
The LoveSac Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-09-05. 51 Massachusetts residents were affected.
New Hampshire State AGas victim2025-09-05
The LoveSac Company notified the New Hampshire Attorney General of a data event affecting 6 NH residents. Unauthorized access occurred between Feb 12 and Mar 3, 2025, involving copying of files containing names and SSNs. LoveSac became aware on Feb 28, 2025. Response included notifying federal law enforcement, providing 24 months of Experian credit monitoring, and reviewing security policies. Investigation is ongoing.
Vermont State AGas victim2025-09-04
The LoveSac Company notified consumers of a phishing incident affecting one employee's email account between May 27-30, 2025. The incident may have exposed customer names and other personal information. The company investigated, secured systems, and is offering 24 months of credit monitoring. Approximately 7 Rhode Island residents are impacted.
Massachusetts State AGas victim2025-09-04
The LoveSac Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-09-04. 49 Massachusetts residents were affected.
Indiana State AGas victim2025-09-04
The LoveSac Company reported a data breach to the Indiana Attorney General. The breach occurred on 2025-02-12 and was reported on 2025-09-04. 28 Indiana residents were affected. 1,840 individuals affected in total.
Nebraska State AGas victim2025-09-04
The LoveSac Company notified Nebraska regulators of a breach affecting 12 state residents. Between May 27-30, 2025, an unauthorized actor accessed one employee's email account, potentially exposing names, SSNs, and financial account data. LoveSac discovered the activity on May 30, 2025, and sent notices on September 4, 2025. Response included forensic investigation, credit monitoring via Experian, and employee training.
Indiana State AGas victim2025-09-04
The LoveSac Company reported a data breach to the Indiana Attorney General. The breach occurred on 2025-05-27 and was reported on 2025-09-04. 42 Indiana residents were affected. 2,299 individuals affected in total.
Maine State AGas victim2025-09-04
The LoveSac Company reported a data breach affecting 7 Maine residents. Unauthorized access to one employee's email account occurred between May 27 and May 30, 2025. The incident involved the potential exposure of names and Social Security numbers. LoveSac discovered the suspicious activity on May 30, 2025, and notified affected individuals on September 4, 2025, offering 24 months of credit monitoring.
Maine State AGas victim2025-09-04
The LoveSac Company reported an external system breach (hacking) occurring between Feb 12 and Mar 3, 2025, discovered on Feb 28, 2025. An unauthorized actor accessed systems and copied files containing names and Social Security numbers. Five Maine residents were notified on Sep 4, 2025. The company engaged federal law enforcement and provided 24 months of credit monitoring via Experian. Investigation is ongoing.
Vermont State AGas victim2025-09-04
The LoveSac Company notified consumers of a cybersecurity incident occurring between Feb 12 and Mar 3, 2025. An unauthorized actor accessed systems and copied files containing names and other personal information. The company offered 24 months of credit monitoring via Experian. Rhode Island residents were specifically noted as impacted.
New Hampshire State AGas victim2025-09-04
The LoveSac Company notified the New Hampshire Attorney General of a data event affecting 12 state residents. Between May 27 and May 30, 2025, an unauthorized actor accessed one employee's email account, potentially exposing names and Social Security numbers. LoveSac discovered the suspicious activity on May 30, 2025, and provided notices to affected residents on September 4, 2025. Response measures included 24 months of complimentary credit monitoring via Experian and enhanced employee safeguards.
Nebraska State AGas victim2025-09-04
The LoveSac Company notified Nebraska AG of a breach occurring Feb 12–Mar 3, 2025, discovered Feb 28, 2025. Unauthorized actors accessed systems and copied files containing names, SSNs, and financial account info. 7 Nebraska residents were notified on Sep 4, 2025. LoveSac provided 24 months of Experian credit monitoring and notified federal law enforcement. Investigation is ongoing.
GLOBALLeak Siteas victim2025-02-28
LoveSac is a U.S-based company specializing in modern furniture products. Their product line includes original foam-filled Lovesac bean bags and modular, adjustable Sactionals. These pieces offer customization in design and are made with sustainability in mind. Additionally, Lovesac provides a range of home accessories like blankets, footsacs, and pillows. Their products combine comfort, durability, and an eco-friendly ethos.
Maine State AGas victim2023-08-30
On July 27, 2023, The Lovesac Company discovered an inadvertent disclosure of personal information affecting 208 individuals, including two Maine residents. The compromised data included names and Social Security numbers. The company notified the affected individuals on August 30, 2023, and offered 24 months of credit monitoring and identity restoration services through Experian.