HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Kayser-Roth, Inc.

bd_2f2fe78801d349ce · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 9, 2017

To disclose

—

Affected

6,488

Linked

3 filings

Confidence

66%

Full breach record for Kayser-Roth, Inc. →3 incidents on file

Kayser-Roth Corporation notified customers of a data breach involving its third-party e-commerce vendor, Aptos Inc. Unauthorized access to Aptos' system occurred between July 1 and August 9, 2017, compromising names, addresses, email addresses, and payment card information (including verification codes) for 6,488 customers. Aptos engaged a cybersecurity firm and notified the FBI. The intrusion is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 1, 2017

Begins

Oct 9, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_47793c866771fd682017-10-09Verified
Massachusetts State AGbd_68007528f18f752d2017-10-09Verified

Name: Kayser-Roth, Inc.
norm: kayser roth

Name: Kayser-Roth, Inc.
norm: kayser roth
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jul 1, 2017 – Aug 9, 2017
Materiality determined: —
Notification sent: Oct 6, 2017
Affected individuals: 6,488nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified the FBI
Third party: via Aptos Inc.
Initial access: supply_chain

During the incident: Engaged a leading cybersecurity firm to help determine the scope of the intrusion
Notified the FBI of the data breach
Established a dedicated, toll-free hotline for customer questions
Changes made: Put in place appropriate measures to strengthen their e-commerce platform
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 9 · first

Massachusetts State AGOct 9 · first

California State AGOct 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-102489
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2017
Raw hash: 6c0b7f435e01c983f46e53b3b8aa07826c103d7608d63dda9b5600749ba86a83

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKayser-Roth, Inc.

Victim entityKayser-Roth, Inc.

IncidentThird-Party / Supply Chain

Stated responseEngaged a leading cybersecurity firm to help determine the scope of the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov