MalwareRetail & ConsumerRetailCapture Stored DataData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)LowContained

RM Acquisition

bd_04d21df1ad5ac628 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 28, 2017

Filed

May 5, 2017

To disclose

9 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for RM Acquisition →2 incidents on file

Rand McNally (RM Acquisition, LLC) disclosed a data breach affecting customer credit card and personal information. Malware installed on the e-commerce server allowed unauthorized access to data from April 12, 2016, to March 2, 2017. The company became aware of suspicious activity on February 28, 2017, and confirmed data collection around April 11, 2017. Affected data includes card numbers, CVVs, expiration dates, and billing/shipping addresses. The company removed the malware, engaged forensic investigators, and is offering one year of identity monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 322 days

discovery → filing · 9 weeks / 66 days

Apr 12, 2016

Begins

Feb 28, 2017

Discovered

May 5, 2017

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_0c088de827cae2942017-05-05Verified
Montana State AGbd_e46d73878171e1122017-05-05Verified
New Hampshire State AGbd_edbe2f6d86d762892017-05-05Verified

Name: RM Acquisition
norm: rm acquisition

Name: RM Acquisition
norm: rm acquisition
Also named: RM Acquisition, LLCdba oflegal entity
Rand McNallydba oftrade name
Industry: Retail & Consumerllm

Discovered: Feb 28, 2017
Breach occurred: Apr 12, 2016 – Mar 2, 2017
Undetected for: 322 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reporting the incident and pertinent details to the appropriate agencies
Initial access: exploit_public_facing

During the incident: Began investigating the server
Removed the malware to prevent any further potential access
Worked with leading cyber investigators to determine what happened
Reporting the incident and pertinent details to the appropriate agencies
Notifying those who may be affected as they are identified
Providing information on the incident and what they can do to protect against possible fraud
Changes made: Offering 1 year of complimentary identity monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGMay 5 · first

Montana State AGMay 5 · first

New Hampshire State AGMay 5 · first

California State AGMay 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-68604
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2017
Raw hash: b7c672a416b0d0eca64e5fd0ff9031b8dcc55b798cb2bf476e3436bfa0a076df

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRM Acquisition

Victim entityRM Acquisition

Incidentdiscovered Feb 28, 2017

Stated responseBegan investigating the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov