HackingPIIIdentity (basic)Financial accountAuthenticationLowContained

Incipio, LLC

bd_00ef8d1651ab6fc6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 4, 2016

Filed

Feb 24, 2016

To disclose

20 days

Affected

29state residents only

Linked

4 filings

Confidence

66%

Full breach record for Incipio, LLC →2 incidents on file

Incipio, LLC reported a data breach affecting customers who purchased from www.incipio.com between September 26, 2015, and January 29, 2016. On February 4, 2016, Incipio discovered an unauthorized party gained access to cloud-based servers during a software update. Exposed data included names, addresses, phone numbers, emails, credit/debit card numbers, expiration dates, and CVVs. Incipio engaged Kroll for identity monitoring and retained an IT security firm.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 131 days

discovery → filing · 20 days

Sep 26, 2015

Begins

Feb 4, 2016

Discovered

Feb 24, 2016

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_916c7c826b4378782016-02-23 · +1dVerified
Massachusetts State AGbd_719cae12f4ba8cc82016-02-26 · +2dCandidate
California State AGbd_a3145b345e29d5d22016-02-22 · +2dCandidate

Name: Incipio, LLC
norm: incipio
Domain: myincipio.com

Name: Incipio, LLC
norm: incipio
Domain: myincipio.com

Discovered: Feb 4, 2016
Breach occurred: Sep 26, 2015 – Jan 29, 2016
Undetected for: 131 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 29state-resident count only
Data types: PIIIdentity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took immediate measures to remove the malware and any file containing your personal information
Continue to monitor for this malware and other risks as part of our ongoing efforts to protect your personal information
Increased our website security efforts and bolstered malware defenses
Retaining an outside network management and information technology security firm to assist us in best securing our servers and data
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Increased our website security efforts and bolstered malware defenses
Retaining an outside network management and information technology security firm to assist us in best securing our servers and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

California State AGFeb 22 · first

Massachusetts State AG+1d

Montana State AG+2d · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Incipio-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2016
Raw hash: d5246f66be936b781f9eb397c6131a059e1e38492755e2555a261ba5abb7c630

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityIncipio, LLC

Victim entityIncipio, LLC

Incidentdiscovered Feb 4, 2016

Stated responseTook immediate measures to remove the malware and any file containing your personal information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov