HackingTechnologyRetail & ConsumerInformationStolen CredentialsCapture Stored DataTargetedData ExfiltratedPCIFinancial accountLowContained

Sterling Valley Systems, Inc. d/b/a Inntopia

bd_1c34b4326fd117a8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 18, 2022

Filed

Oct 7, 2022

To disclose

33 weeks

Affected

306state residents only

Linked

5 filings

Confidence

65%

Sterling Valley Systems, Inc. d/b/a Inntopia notified individuals of unauthorized access to payment card information between Oct 9, 2021 and Feb 18, 2022. The breach was discovered on Feb 18, 2022. Notices were sent in October 2022. Credit monitoring via Experian was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 132 days

discovery → filing · 33 weeks / 231 days

Oct 9, 2021

Begins

Feb 18, 2022

Discovered

Oct 7, 2022

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_f54c78eb36b3ce652022-10-07Verified
Maine State AGbd_5553204a3505e9a42022-10-10 · +3dVerified
Oregon State AGbd_984a53ff6ad8f9bf2022-10-17 · +10dVerified
Washington State AGbd_9d320e2b5409e9132022-10-17 · +10dVerified

Name: Barran Liebman LLP
norm: barran liebman

Name: Sterling Valley Systems, Inc. d/b/a Inntopia
norm: sterling valley systems inntopia
Also named: Sterling Valley Systems, Inc.dba oflegal entity
Inntopiadba oftrade name
Industry: TechnologyllmRetail & Consumerllm

Discovered: Feb 18, 2022
Breach occurred: Oct 9, 2021 – Feb 18, 2022
Undetected for: 132 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2022
Affected individuals: 306state-resident count only
Data types: PCIFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: notifying payment card brands and law enforcement
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Confirming the security of our systems
Notifying payment card brands and law enforcement
Strengthening our technical controls
Implementing additional security measures
Offering complimentary access to credit monitoring services through Experian
Changes made: Strengthening our technical controls
Implementing additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGOct 7 · first

Montana State AGOct 7 · first · this page

Maine State AG+3d

Oregon State AG+10d

Washington State AG+10d

Pattern: first filing Oct 7 (IN), last Oct 17 (WA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-618.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 7, 2022
Raw hash: 6ee55422f8f567fc18b8441bd12e68866cc51dc0ea0c77a7e3f3d6a85c45f535

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBarran Liebman LLP

Victim entitySterling Valley Systems, Inc. d/b/a Inntopia

Incidentdiscovered Feb 18, 2022

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov