HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedTargetedPIIFinancial accountIdentity (basic)LowContained

Metabolic Maintenance Products, Inc.

bd_1c1326d9cd7e560f · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 9, 2021

Filed

Sep 16, 2021

To disclose

10 weeks

Affected

161state residents only

Linked

4 filings

Confidence

65%

Full breach record for Metabolic Maintenance Products, Inc. →4 incidents on file

Metabolic Maintenance Products, Inc. notified Montana AG of a data breach involving unauthorized access to its website. An unknown third party installed malicious code between May 2020 and July 9, 2021, capturing names, addresses, and payment card details. The company engaged forensic investigators, removed the code, and notified law enforcement and credit card brands.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 434 days

discovery → filing · 10 weeks / 69 days

May 1, 2020

Begins

Jul 9, 2021

Discovered

Sep 16, 2021

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_02657066f49b5ed72021-09-16Verified
California State AGbd_598facb0d98549ca2021-09-16Verified
Maine State AGbd_a85bb19664898a7c2021-09-16Verified

Name: Metabolic Maintenance Products, Inc.
norm: metabolic maintenance products

Name: Metabolic Maintenance Products, Inc.
norm: metabolic maintenance products
Industry: Retail & Consumerllm

Discovered: Jul 9, 2021
Breach occurred: May 1, 2020 – Jul 9, 2021
Undetected for: 434 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2021
Affected individuals: 161state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Engaged a forensic security firm to conduct an in-depth investigation
Removed the unauthorized code from the website
Notified the credit card brands
Notified law enforcement
Changes made: Implemented an updated firewall configuration
Increased logging
Implemented traffic detection
Developing a new, state-of-the-art website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 16 · first

California State AGSep 16 · first

Maine State AGSep 16 · first

Montana State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: d7eb09f186f8beb4ceeb008fa4bffdb3bb2edd5de1c6288676eb61e1db028d03

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMetabolic Maintenance Products, Inc.

Victim entityMetabolic Maintenance Products, Inc.

Incidentdiscovered Jul 9, 2021

Stated responseEngaged a forensic security firm to conduct an in-depth investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov