Flurish Inc. data breach (2016)

Breach window

Jan 1, 2012 → Jan 1, 2016

When the intrusion reportedly occurred, per the linked filings

1,461 days

Breach discovered

Jan 1, 2016

Reported by CALIFORNIA AG filing

91 days

Breach discoveredconflicts with Jan 1, 2016AG web form

Apr 1, 2016

Reported by OREGON AG filing

45 days

🐻California State AGFirst filinglinked via multistate filing link · 100%

Filed May 16, 2016bd_01a06f041ef29f23

Flurish Inc. (dba LendUp) submitted a California SB-24 breach notification regarding a 2012-2016 incident where third-party website widgets and analytics trackers inadvertently collected customer PII, including names, emails, addresses, DOBs, and SSNs. The breach was discovered in early 2016 during a routine examination. LendUp notified affected individuals, offered 12 months of AllClear ID identity protection, and implemented new controls. No misuse of data was believed to have occurred.

🦫Oregon State AGMost recent

Filed May 16, 2016bd_4667c499107624a7

Flurish Inc. dba LendUp reported a data breach to the Oregon Attorney General. The breach was reported on 2016-05-16. The breach occurred during 6/21/2012. The breach was discovered on 4/1/2016. 12,038 individuals were affected. Notice was sent on 5/11/2016.

Affected (this filing): 12,038

OR AG ≤45d

Flurish Inc.

Litigation Timing

Timeline