HackingTechnologyRetail & ConsumerInformationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsMediumContained

Aptos

bd_0ef30bb08f7149d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2016

Filed

Feb 25, 2017

To disclose

17 weeks

Affected

2,858state residents only

Linked

6 filings

Confidence

66%

Full breach record for Aptos →

Aptos, Inc. notified the NH Attorney General of a remote access intrusion affecting online retailers' transaction data. The incident occurred Feb-Dec 2016, discovered Nov 2016. Data exposed included names, addresses, payment card numbers, and CVVs. 2,858 NH residents affected. Aptos engaged cybersecurity firm to remove malware and strengthen access controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 17 weeks / 116 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Feb 25, 2017

Filed

vs. sector median

+4 wks slower

This filing is one of 6 about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_7b839a7a8a9f571c2017-02-25Verified
Massachusetts State AGbd_240674ed1319758d2017-02-27 · +2dVerified
California State AGbd_3b0817bc12a5f5cb2017-02-27 · +2dVerified
New Hampshire State AGbd_d70604f71608d8642017-03-03 · +6dVerified

Show 1 more filing ↓up to 27d gap

Oregon State AGbd_95597eac1553f5362017-03-24 · +27dCandidate

Name: Aptos
norm: aptos
Domain: aptos.com

Name: Aptos
norm: aptos
Domain: aptos.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2017
Affected individuals: 2,858state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported matter to the FBI and the U.S. Department of Justice
Initial access: exploit_public_facing

During the incident: Worked with a leading cybersecurity firm to remove the malware from its systems
Made security updates to the systems
Strengthened access controls
Reported this matter to the FBI and the U.S. Department of Justice
Changes made: Strengthened access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

California State AGFeb 25 · first

New Hampshire State AGFeb 25 · first · this page

Massachusetts State AG+2d

California State AG+2d

New Hampshire State AG+6d

Oregon State AG+27d

Pattern: first filing Feb 25 (CA), last Mar 24 (OR) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aptos-20170225.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2017
Raw hash: 90a619fe1b822b2c19ac1e0ed3cae364673c40b6c80c786be319eb780ee9147e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAptos

Victim entityAptos

Incidentdiscovered Nov 1, 2016

Stated responseWorked with a leading cybersecurity firm to remove the malware from its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov