Used Bikes Direct, LLC

Supplemental breach notice filed by Used Bikes Direct, LLC with the Idaho Attorney General. The attached PDF document contains only page separators and no extractable narrative, dates, data types, or incident details. No specific breach details could be extracted from the provided source.

Used Bikes Direct, LLC (UBD) notified the Idaho Attorney General of a data breach affecting 6 Idaho residents. Beginning January 17, 2025, a malicious actor compromised UBD's authorized login credentials for the CRSS Credit API (Portal). The actor accessed historical consumer credit reports and personal information, including names, SSNs, addresses, and salary data. The breach was discovered by CRS in March 2025. UBD offered 12 months of credit monitoring via TransUnion/Cyberscout and implemented MFA and additional security reviews.

Used Bikes Direct, LLC notified New Hampshire residents that a third-party credit platform account (CRSS Credit API) was compromised between January 17, 2025, and March 2025. The attacker used stolen credentials to view historical consumer credit reports. The company blocked access, offered free credit monitoring via Cyberscout, and determined on April 4, 2025, that specific individuals' data was accessible.

Used Bikes Direct LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2025-01-17 and was reported on 2025-05-12. 10 Indiana residents were affected. 1,601 individuals affected in total.