HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

IM Shopping, Inc.

bd_08ccb4f9267d0727 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 21, 2019

Filed

Jun 26, 2019

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for IM Shopping, Inc. →

IM Shopping, Inc. notified consumers of a data breach affecting the Gift Card Mall website. An unauthorized script was placed in the site code between April 24 and May 21, 2019, designed to forward consumer input from order forms to an external site. The incident was discovered on May 21, 2019. Affected data included names, addresses, payment card numbers, expiration dates, and security codes. The company engaged a cybersecurity firm, removed the script, logged out affected users, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 21, 2019 → Notified Jun 14, 201924d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 27 days

discovery → filing · 5 weeks / 36 days

Apr 24, 2019

Begins

May 21, 2019

Discovered

Jun 26, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_12a6e44683fb242e2019-06-26Verified
New Hampshire State AGbd_f08bf0d1d6a763f12019-06-26Verified

Name: IM Shopping, Inc.
norm: im shopping
Domain: giftcardmall.com

Name: IM Shopping, Inc.
norm: im shopping
Domain: giftcardmall.com
Industry: Retail & Consumerllm

Discovered: May 21, 2019
Breach occurred: Apr 24, 2019 – May 21, 2019
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a leading cybersecurity firm
Removed the unauthorized script from the code of the GCM website
Logged out all users who interacted with the GCM website between April 24, 2019 and May 21, 2019
Changes made: Providing access to 24 months of MyIDCare credit monitoring and identity protection services at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: CA 60-day OK · 24d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 21, 2019
→ Notified: Jun 14, 2019
24d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 21, 2019 → Notified: Jun 14, 2019	24d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJun 26 · first

New Hampshire State AGJun 26 · first

California State AGJun 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-148456
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2019
Raw hash: fc1cd314063d6f03f6f92805d69aabdfe88de175a784ea9d0fb7ea56d0c9587c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityIM Shopping, Inc.

Victim entityIM Shopping, Inc.

Incidentdiscovered May 21, 2019

Stated responseLaunched an investigation with the assistance of a leading cybersecurity firm

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov