Skip to content

Volusion

Disclosed Apr 20, 20206 years ago541,000 affectedConfirmed

Official notice

What is known

People affected541,000 (as reported by the organization)
DisclosedApr 20, 2020
DiscoveredOct 8, 2019
HappenedSep 7, 2019
AttackHacking
Data exposedNames, Credentials and tokens, Payment cards, Financial
SectorOther · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Volusionoag.ca.gov · Official notice
Washington Attorney General breach notice: Volusionatg.wa.gov · Official notice
Notice letter filed with the Delaware DOJ: Volusionattorneygeneral.delaware.gov · Official notice
Oregon DOJ breach notice: Volusionjustice.oregon.gov · Official notice
Indiana Attorney General 2020 data breach report: Volusionin.gov · Official notice
Maine Attorney General breach notice archive: Volusionmaine.gov · Official notice

Notices filed

WhereFiledPeople
California AGresidents of CAApr 20, 2020
Washington AGresidents of WAApr 20, 202014,111
Delaware DOJresidents of DEApr 20, 2020
Indiana AGresidents of INApr 20, 20207,914
Maine AGresidents of MEApr 20, 20202,305
Oregon DOJresidents of ORApr 21, 202054,100
History of this record
  • 2026-09-25 · data_types: ["names","credentials"] to ["names","credentials","payment-card","financial"] · backfill source
  • 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdf · backfill source
  • 2026-09-25 · data_types: [] to ["names","credentials"] · backfill source
  • 2026-09-25 · records_basis: empty to organization · backfill source
  • 2026-09-25 · records: empty to 541000 · backfill source
  • 2026-09-25 · attack: unknown to hacking · backfill source
  • 2026-09-25 · discovered: empty to 2019-10-08 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Volusion

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.