Tatcha, LLC reported a data breach occurring in early 2017 where an unauthorized actor accessed information entered during the online checkout process. Affected data included credit card numbers, expiration dates, CVVs, email addresses, passwords, names, and addresses. Tatcha notified affected individuals in May 2017, offered 24 months of identity protection via AllClear ID, and reported the incident to law enforcement.