HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Indiana Oxygen Company

bd_03d61ff230d80cdf · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 27, 2023

Filed

Apr 13, 2023

To disclose

6 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for Indiana Oxygen Company →2 incidents on file

Indiana Oxygen Company (IOC) subsidiaries Welding Supplies from IOC and Weld My Ride experienced an unauthorized access incident involving malicious code injected into their eCommerce platform. The exposure window was September 25, 2022, to February 27, 2023, when the code was identified and removed. Affected data includes names, addresses, emails, phone numbers, and credit/debit card information. IOC engaged law enforcement and forensic specialists and is switching to a more secure eCommerce platform.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 155 days

discovery → filing · 6 weeks / 45 days

Sep 25, 2022

Begins

Feb 27, 2023

Discovered

Apr 13, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_e6123d6c09344b722023-04-13Verified
Vermont State AGbd_1de4bf28669faeea2023-04-27 · +14dVerified
California State AGbd_066c50ae87368a732023-04-29 · +16dVerified
Maine State AGbd_a5a89186348f975e2023-04-29 · +16dVerified

Name: Indiana Oxygen Company
norm: indiana oxygen

Name: Indiana Oxygen Company
norm: indiana oxygen
Industry: Retail & Consumerllm

Discovered: Feb 27, 2023
Breach occurred: Sep 25, 2022 – Feb 27, 2023
Undetected for: 155 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Worked with law enforcement to find and completely remove the code
Working together with cybersecurity and forensic specialists to investigate this incident
Changes made: Enhance existing information technology procedures
Switching eCommerce platforms to a more secure platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Maine State AGApr 13 · first

California State AGApr 13 · first · this page

Vermont State AG+14d

California State AG+16d

Maine State AG+16d

Pattern: first filing Apr 13 (ME), last Apr 29 (ME) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565483
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2023
Raw hash: 0159d72ae6344c899b57804f63918bf4a3252a6308177056a4fb6808e7c1ec71

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityIndiana Oxygen Company

Victim entityIndiana Oxygen Company

Incidentdiscovered Feb 27, 2023

Stated responseWorked with law enforcement to find and completely remove the code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov