HackingRetail & ConsumerTechnologyRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Alpha Industries, Inc.

bd_1c6782b4d4176a49 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 25, 2017

Filed

Oct 26, 2017

To disclose

9 weeks

Affected · nationwide

1,5006 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Alpha Industries, Inc. →2 incidents on file

Alpha Industries, Inc. supplements its October 2, 2017 notice regarding a data breach involving third-party provider Aptos, Inc. The intrusion occurred between July 6 and August 9, 2017, affecting approximately 1,500 customers nationwide, including 6 in New Hampshire. Stolen data included names, addresses, emails, and payment card details with CVVs. Alpha is offering one year of credit monitoring and has engaged forensic investigators and law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 9 weeks / 62 days

Jul 6, 2017

Begins

Aug 25, 2017

Discovered

Oct 26, 2017

Filed

vs. sector median

on median

This filing is one of 4 filings about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_104ddce62dce811b2017-11-01 · +6dCandidate
Massachusetts State AGbd_48f5fd52f86156f22017-10-02 · +24dVerified
New Hampshire State AGbd_97a8198f47b980b22017-10-02 · +24dCandidate

Name: Alpha Industries, Inc.
norm: alpha industries
Domain: alphaindustries.com

Name: Alpha Industries, Inc.
norm: alpha industries
Domain: alphaindustries.com
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Aug 25, 2017
Breach occurred: Jul 6, 2017 – Aug 9, 2017
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2017
Affected individuals: 1,500state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralNotified relevant state agenciesOffered cooperation with the Federal Bureau of Investigation
Third party: via Aptos, Inc.
Initial access: supply_chain

During the incident: Engaged a leading cybersecurity firm to determine the scope of the matter
Removed the malicious code
Disabled the page used to gain access to its system
Filtered the code to remove non-alphanumeric characters
Created an alert designed to highlight attempts to modify the code
Contacted and offered cooperation with federal law enforcement, specifically the Federal Bureau of Investigation
Provided written notice to affected customers
Established a call center to provide information to affected customers
Changes made: Offering complimentary credit monitoring and an identity theft restoration product by TransUnion for one year
Improved the security of its e-commerce solution
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 2 · first

New Hampshire State AGOct 2 · first

New Hampshire State AG+24d · this page

Massachusetts State AG+30d

Pattern: first filing Oct 2 (MA), last Nov 1 (MA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alpha-industries-20171026.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2017
Raw hash: b0ab130cd03f4eb06092c3cdfa0e6b80bb35e64c1ae76e1cab240325e7884290

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAlpha Industries, Inc.

Victim entityAlpha Industries, Inc.

Incidentdiscovered Aug 25, 2017

Stated responseEngaged a leading cybersecurity firm to determine the scope of the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov