HackingRetail & ConsumerManufacturingRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountMediumResolved

Intex Recreation Corp

bd_08f0693cc43475e2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2016

Filed

Feb 22, 2017

To disclose

14 weeks

Affected

1,547state residents only

Linked

6 filings

Confidence

69%

Full breach record for Intex Recreation Corp →

Intex Recreation Corp. notified the Washington AG of a security incident discovered on Nov 16, 2016. Unauthorized access occurred between Apr 24 and Dec 14, 2016, via malicious code on its website. Customer PII and credit card info were accessed. 1,547 WA residents affected. Notices sent Feb 23, 2017. Forensic investigation completed Feb 3, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 206 days

discovery → filing · 14 weeks / 98 days

Apr 24, 2016

Begins

Nov 16, 2016

Discovered

Feb 22, 2017

Filed

vs. sector median

+6 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_78536aea4c593a6e2017-02-22Verified
Montana State AGbd_b7aafdc77e09730e2017-02-22Verified by operator
California State AGbd_2d452ad91e0a958f2017-02-20 · +2dVerified
Oregon State AGbd_4845dadec40ea6ff2017-02-27 · +5dVerified

Show 1 more filing ↓up to 5d gap

Massachusetts State AGbd_679019bfe2a40caf2017-02-17 · +5dVerified

Name: Intex Recreation Corp
norm: intex recreation

Name: Intex Recreation Corp
norm: intex recreation
Industry: Retail & ConsumerllmManufacturingllm

Discovered: Nov 16, 2016
Breach occurred: Apr 24, 2016 – Dec 14, 2016
Undetected for: 206 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2017
Affected individuals: 1,547state-resident count only
Data types: PIIIdentity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 200-299d
WA-stated discovery: Found while ongoing
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation
Began working with third-party forensic investigators
Removed the malicious code
Completely rebuilt the website on a new server and added new protections
Providing the affected individuals with information they can use to better protect against identity theft and fraud
Access to one year of identity protection services free of charge
Changes made: Removed the malicious code
Completely rebuilt the website on a new server and added new protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 17 · first

California State AG+3d

New Hampshire State AG+5d

Montana State AG+5d

Washington State AG+5d · this page

Oregon State AG+10d

Pattern: first filing Feb 17 (MA), last Feb 27 (OR) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9667.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2017
Raw hash: 93244525cd233456df017639ff0d8f1f2f9a517abf9036c5b7021a53b34fcb01

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityIntex Recreation Corp

Victim entityIntex Recreation Corp

Incidentdiscovered Nov 16, 2016

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com