HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedFinancial accountIdentity (basic)CredentialsLowContained

ZERO Technologies

bd_2d50c515ac0cbd9f · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 15, 2019

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for ZERO Technologies →

Zero Technologies, LLC (operating as Zero Water) disclosed that a vulnerability on its website was exploited, leading to unauthorized access to customer payment card information. The breach window is listed as November 4, 2018, to April 9, 2019, with exploitation confirmed around May 24, 2019. Affected data includes credit/debit card numbers, CVVs, expiration dates, names, addresses, phone numbers, emails, and account passwords. The company engaged forensic investigators and implemented additional security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 4, 2018

Begins

Jul 15, 2019

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_1005be4dfddc64e22019-07-12 · +3dVerified
Montana State AGbd_835ceef124e59e032019-07-12 · +3dCandidate

Name: ZERO Technologies
norm: zero technologies
Domain: zerohvacr.us

Name: ZERO Technologies
norm: zero technologies
Domain: zerohvacr.us
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 4, 2018 – Apr 9, 2019
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Worked with a third-party forensic investigator
Worked with website provider to identify the source of the activity
Confirmed the security of our network
Changes made: Underwent an extensive independent security audit of our web site
Additional security measures were put in place to further strengthen the security and protection of credit card data
Significant enhancements were also implemented to optimize the security of our technology for future transactions
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 12 · first

Montana State AGJul 12 · first

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-148911
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2019
Raw hash: 06283f9a16b9c5232235f776fdf9c102b6f06d76221db671ac99b6dd9d356b3b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityZERO Technologies

Victim entityZERO Technologies

IncidentUnauthorized Access

Stated responseWorked with a third-party forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov