HackingRetail & ConsumerTechnologyRetailVulnerability ExploitCapture Stored DataTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Ketterer Company

bd_264e657089c5e236 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2020

Filed

Jun 1, 2020

To disclose

14 weeks

Affected

5state residents only

Confidence

64%

Ketterer Company notified affected individuals of a data security incident involving malicious scripting on KnightsGear.com from Feb 7 to May 6, 2020. The script harvested customer PII and payment card data. Ketterer detected the issue on Feb 24, 2020, engaged forensic investigators, and closed the store. Notices were sent June 23, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 14 weeks / 98 days

Feb 7, 2020

Begins

Feb 24, 2020

Discovered

Jun 1, 2020

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Name: Ketterer Company
norm: ketterer company

Name: Ketterer Company
norm: ketterer company
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Feb 24, 2020
Breach occurred: Feb 7, 2020 – May 6, 2020
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 23, 2020
Affected individuals: 5state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a digital forensics firm to help determine what happened
Closed the online store in response to COVID-19 social distancing measures
Added additional safeguards to minimize the chance that an incident like this could occur in the future
Changes made: Added additional safeguards to minimize the chance that an incident like this could occur in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-113.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2020
Raw hash: 21bfd146281c8e788fcfef4ce2372b6da075c516c7e23a595c41fc2db32940a7

Reporting entityKetterer Company

Victim entityKetterer Company

Incidentdiscovered Feb 24, 2020

Stated responseEngaged a digital forensics firm to help determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov