HackingRetail & ConsumerTechnologyRetailSQL InjectionCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

APISource, Inc.

bd_22d972002b95e347 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2020

Filed

May 4, 2020

To disclose

6 weeks

Affected

4state residents only

Linked

4 filings

Confidence

65%

Full breach record for APISource, Inc. →

APISOURCE Inc. notified customers of a data breach involving malicious code on its ecommerce platform that captured customer PII and payment card data from Dec 2019 to Apr 2020. The company engaged forensic investigators and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 106 days

discovery → filing · 6 weeks / 41 days

Dec 9, 2019

Begins

Mar 24, 2020

Discovered

May 4, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_4968388dab3ff8f62020-05-04Verified
New Hampshire State AGbd_460507e2e31b887f2020-05-08 · +4dVerified
Massachusetts State AGbd_8c0df36f0b5936232020-05-08 · +4dVerified

Name: APISource, Inc.
norm: apisource

Name: APISource, Inc.
norm: apisource
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Mar 24, 2020
Breach occurred: Dec 9, 2019 – Apr 3, 2020
Undetected for: 106 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2020
Affected individuals: 4state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Began an investigation, with the assistance of a third-party forensic investigator
Offering you access to one year of complimentary identity monitoring services through Kroll
Changes made: Reviewed its internal procedures and implemented additional safeguards on its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 4 · first

Montana State AGMay 4 · first · this page

New Hampshire State AG+4d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-165.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2020
Raw hash: 6ba63e754e3e30c9771ff88d43b3ac14ff306220de709a5e0e9708242bed726b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAPISource, Inc.

Victim entityAPISource, Inc.

Incidentdiscovered Mar 24, 2020

Stated responseBegan an investigation, with the assistance of a third-party forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov