HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIFinancial accountIdentity (basic)MediumContained

Title Nine

bd_1298f41485b85577 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 25, 2018

Filed

Nov 12, 2018

To disclose

18 days

Affected

1,143state residents only

Linked

3 filings

Confidence

64%

Full breach record for Title Nine →6 incidents on file

Title Nine Sports notified customers of a third-party vendor breach involving Annex Cloud. Unauthorized code inserted into Annex Cloud's systems captured checkout data (names, addresses, payment card numbers, CVVs) between Dec 2017 and July 2018. Title Nine removed the code and notified affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 301 days

discovery → filing · 18 days

Dec 28, 2017

Begins

Oct 25, 2018

Discovered

Nov 12, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_57e8855c3c9b81362018-11-12Verified by operator
Washington State AGbd_99f67b26fc79a9402018-11-12Verified by operator

Name: Title Nine
norm: title nine
Domain: titlenine.com

Name: Title Nine
norm: title nine
Domain: titlenine.com
Industry: Retail & Consumernaics map

Discovered: Oct 25, 2018
Breach occurred: Dec 28, 2017 – Jul 9, 2018
Undetected for: 301 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2018
Affected individuals: 1,143state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input Capture
Threat actor: ExternalFinancial
Third party: via Annex Cloud
Initial access: supply_chain

During the incident: Removed Annex Cloud’s code from our website
Mailed letters to those customers
Removed the Annex Cloud application
Continuing to take steps to strengthen the security of our website
Changes made: Removed the Annex Cloud application
Taking steps to strengthen the security of our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Oregon State AGNov 12 · first

Washington State AGNov 12 · first

Montana State AGNov 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Title-Nine-Sports.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2018
Raw hash: 57c7d0604c011c72b5e5c59f41d07ba67a8c48feb7b8b724a19d8de41a9e251b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTitle Nine

Victim entityTitle Nine

Incidentdiscovered Oct 25, 2018

Stated responseRemoved Annex Cloud’s code from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov