HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

Implant Direct

bd_08f27f4e04506389 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 4, 2019

Filed

Jul 5, 2019

To disclose

4 weeks

Affected

1state residents only

Confidence

64%

Full breach record for Implant Direct →

Implant Direct notified Montana AG of a breach affecting customers who placed orders between May 30 and June 4, 2019. Suspicious activity was detected on June 4, 2019. An unauthorized party accessed names, addresses, phone numbers, and payment card data (including CVV). No SSN was involved. The company engaged forensic investigators, notified law enforcement, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 4 weeks / 31 days

May 30, 2019

Begins

Jun 4, 2019

Discovered

Jul 5, 2019

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Implant Direct
norm: implant direct
Domain: implantdirect.com

Name: Implant Direct
norm: implant direct
Domain: implantdirect.com
Industry: Retail & Consumerllm

Discovered: Jun 4, 2019
Breach occurred: May 30, 2019 – Jun 4, 2019
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 5, 2019
Affected individuals: 1state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: contacted law enforcement
Initial access: exploit_public_facing

During the incident: Took immediate steps to terminate the potential unauthorized access
Brought in a leading third party forensic investigation firm to assist in these efforts
Contacted law enforcement
Started working to notify potentially impacted customers
Offering two years of complimentary credit monitoring and identity theft protection service
Changes made: Further secure the online store
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-20.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2019
Raw hash: 13f8d5db05c81526a2af22edccc0434226affb9a06394226e9aa39056b3bc3ee

Reporting entityImplant Direct

Victim entityImplant Direct

Incidentdiscovered Jun 4, 2019

Stated responseTook immediate steps to terminate the potential unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov