HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

Travel Caddy, Inc.

bd_28dec55f16d5ac4f · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 4, 2016

To disclose

—

Affected

3state residents only

Linked

3 filings

Confidence

64%

Full breach record for Travel Caddy, Inc. →

Travel Caddy, Inc. dba Travelon notified customers of a data security incident where malicious code on its server collected credit card information (card number, CVV2, name, address, phone, email) from its shopping cart between Nov 13, 2015 and June 10, 2016. The code may have transmitted data to an outside party. Travelon deactivated the code, implemented monitoring, halted website orders, and offered one year of Equifax Credit Watch Gold identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 13, 2015

Begins

Aug 4, 2016

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_883eb11ac3b535002016-08-04Verified
Massachusetts State AGbd_f6a25a25ae547f942016-08-09 · +5dVerified

Name: Travel Caddy, Inc.
norm: travel caddy
Domain: travelonbags.com

Name: Travel Caddy, Inc.
norm: travel caddy
Domain: travelonbags.com
Also named: Travel Caddy, Inc.dba oflegal entity
Travelondba oftrade name
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 13, 2015 – Jun 10, 2016
Materiality determined: —
Notification sent: Nov 1, 2016
Affected individuals: 3state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Ensured that the malicious code has been deactivated
Set up monitoring of our system to detect any reinsertion of the code
Taken actions to prevent orders from being placed through our website
Notified credit card processing company
Arranged with Equifax to provide Credit Watch Gold identity theft protection product for one year
Changes made: Set up monitoring of our system to detect any reinsertion of the code
Taken actions to prevent orders from being placed through our website until security is ensured
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGAug 4 · first

Montana State AGAug 4 · first · this page

Massachusetts State AG+5d

Pattern: first filing Aug 4 (NH), last Aug 9 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Travel-Caddy-Inc-dba-Travelon.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2016
Raw hash: 939d177e0b60c26a3eebd7c9e572f1e28113fe5f0d7eaf8183ba4203493f4de5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTravel Caddy, Inc.

Victim entityTravel Caddy, Inc.

IncidentUnauthorized Access

Stated responseEnsured that the malicious code has been deactivated

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov