HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

YAPSTONE, INC.

bd_296649eaec588a92 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2015

Filed

Jan 25, 2016

To disclose

25 weeks

Affected

2,896state residents only

Linked

2 filings

Confidence

61%

Full breach record for YAPSTONE, INC. →2 incidents on file

YapStone, Inc. notified affected individuals that unauthorized persons accessed personal information via a YapStone URL between July 15, 2014, and August 5, 2015. The company discovered the breach on August 4, 2015. Exposed data included names, emails, SSNs, driver's licenses, DOBs, and bank account numbers. YapStone blocked access, engaged forensic experts, and provided two years of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due25 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 385 days

discovery → filing · 25 weeks / 174 days

Jul 15, 2014

Begins

Aug 4, 2015

Discovered

Jan 25, 2016

Filed

vs. sector median

+16 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_7b303e874ecf74f52015-12-18 · +38dCandidate

Name: YAPSTONE, INC.
norm: yapstone

Name: YAPSTONE, INC.
norm: yapstone
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 4, 2015
Breach occurred: Jul 15, 2014 – Aug 5, 2015
Undetected for: 385 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2015
Affected individuals: 2,896state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Blocked unauthorized access to the application
Retained outside experts to investigate the incident
Engaged Experian to offer complimentary credit monitoring and identity restoration services
Changes made: Increasing the security protections of the YapStone site
Enhancing and strengthening YapStone’s internal password rules
Enhancing storage mechanisms
Increased active monitoring of the affected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGDec 18 · first

South Carolina State AG+38d · this page

Pattern: first filing Dec 18 (WA), last Jan 25 (SC) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/YapStone%2CInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 25, 2016
Raw hash: c56793a9bec5ff012067245a83f9d6ed17f7528a890a1f363679dd096ab80cad

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityYAPSTONE, INC.

Victim entityYAPSTONE, INC.

Incidentdiscovered Aug 4, 2015

Stated responseBlocked unauthorized access to the application

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov