MalwareRetail & ConsumerRetailSkimmerCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsMediumContained

Tommie Copper

bd_19476cf9a1fafba3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2018

Filed

Jul 11, 2018

To disclose

6 weeks

Affected

2,078state residents only

Linked

5 filings

Confidence

66%

Full breach record for Tommie Copper →2 incidents on file

Tommie Copper Inc disclosed that malware inserted into its e-commerce website collected payment information from customers between November 10, 2017, and January 22, 2018. The incident affected approximately 2,078 California residents. Affected data included names, addresses, phone numbers, email addresses, and credit/debit card numbers, expiration dates, and CVV codes. The company engaged forensic investigators, removed the malware, and implemented enhanced security controls.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 1, 2018 → Notified Jul 11, 201840d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 203 days

discovery → filing · 6 weeks / 40 days

Nov 10, 2017

Begins

Jun 1, 2018

Discovered

Jul 11, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_3cb23ad07d9a6af42018-07-11Verified
Montana State AGbd_3efb04bbd29661162018-07-11Candidate
Massachusetts State AGbd_497d1255cd814fbf2018-07-11Verified
Oregon State AGbd_b64fa8601bc5d5362018-07-11Verified by operator

Name: Tommie Copper
norm: tommie copper

Name: Tommie Copper
norm: tommie copper
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Nov 10, 2017 – Jan 22, 2018
Undetected for: 203 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2018
Affected individuals: 2,078state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified California Attorney GeneralProviding notice to other state regulators as requiredNotified credit reporting agencies
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Retained a third party forensic investigator
Removed the malicious code that led to the vulnerability
Implemented additional security measures to reduce the likelihood of a similar incident from happening in the future
Providing potentially affected individuals with information on how to protect against identity theft and fraud
Providing notice to other state regulators as required
Set up a confidential call center for this matter
Changes made: More rigorous review of all changes made to its code base
Further limiting the number of individuals who can access its website administrative console
Whitelisting of IP addresses to the website administrative console
Further strengthening of requirements for system passwords
Reviewing the Magento Administrative User Audit Report daily
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: CA 60-day OK · 40d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 1, 2018
→ Notified: Jul 11, 2018
40d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 1, 2018 → Notified: Jul 11, 2018	40d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGJul 11 · first

Montana State AGJul 11 · first

Massachusetts State AGJul 11 · first

Oregon State AGJul 11 · first

California State AGJul 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-137818
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2018
Raw hash: 81f06947edf6c1a890e68aa7a40ec2d61fc72d895bf091c2811dbdaed5a24018

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTommie Copper

Victim entityTommie Copper

Incidentdiscovered Jun 1, 2018

Stated responseLaunched an internal investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov