Used Bikes Direct, LLC
ent_cd5b0c997c97aeabd8cad964
Disclosures
6
State AG · 5 jurisdictions
Multi-filing incidents
1
incidents joining 2+ filings here
Max affected reported
1,601
nationwide · State AG IN
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- Used Bikes Direct, LLC
- Normalized
- used bikes direct— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- No match
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- None on record
Disclosure history (6)newest first
- Idaho State AGas victim2025-05-20
Used Bikes Direct, LLC reported a data breach affecting 6 Idaho residents. Beginning Jan 17, 2025, a malicious actor compromised UBD's account with third-party credit platform CRS using stolen credentials. The actor accessed historical consumer credit reports containing names, SSNs, addresses, and salary info. CRS detected the compromise in March 2025. UBD notified the Idaho AG on May 12, 2025, offering 12 months of credit monitoring.
- Massachusetts State AGas victim2025-05-12
Used Bikes Direct, LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-05-12. 7 Massachusetts residents were affected.
- Idaho State AGas victim2025-05-12
Used Bikes Direct, LLC (UBD) notified the Idaho Attorney General of a data breach affecting 6 Idaho residents. Beginning January 17, 2025, a malicious actor compromised UBD's authorized login credentials for the CRSS Credit API (Portal). The actor accessed historical consumer credit reports and personal information, including names, SSNs, addresses, and salary data. The breach was discovered by CRS in March 2025. UBD offered 12 months of credit monitoring via TransUnion/Cyberscout and implemented MFA and additional security reviews.
- New Hampshire State AGas victim2025-05-12
Used Bikes Direct, LLC notified New Hampshire residents that a third-party credit platform account (CRSS Credit API) was compromised between January 17, 2025, and March 2025. The attacker used stolen credentials to view historical consumer credit reports. The company blocked access, offered free credit monitoring via Cyberscout, and determined on April 4, 2025, that specific individuals' data was accessible.
- Indiana State AGas victim2025-05-12
Used Bikes Direct LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2025-01-17 and was reported on 2025-05-12. 10 Indiana residents were affected. 1,601 individuals affected in total.
- Nebraska State AGas victim2025-05-12
Used Bikes Direct, LLC reported a data breach affecting customer credit information. Beginning January 17, 2025, a malicious actor compromised a third-party credit platform account (CRSS Credit API) using valid credentials. The actor accessed historical consumer credit reports containing names, SSNs, addresses, and salary data. The compromise was discovered in March 2025. The company blocked access and provided 12 months of free credit monitoring to affected individuals.