HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsDelayed DiscoveryMulti-Stage ChainCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

Alton Lane Inc.

bd_3134e18a41e0d657 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2017

Filed

Jan 10, 2018

To disclose

10 weeks

Affected

3state residents only

Linked

3 filings

Confidence

65%

Full breach record for Alton Lane Inc. →

Alton Lane Inc. notified Montana of a data breach involving unauthorized access to its website (altonlane.com) via injected malicious code. Access occurred from Nov 2016 to Nov 2017. Compromised data likely included names, addresses, phone numbers, and credit card information. No definitive evidence of data export was found. Alton Lane engaged a third-party security agency and secured its systems.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 365 days

discovery → filing · 10 weeks / 70 days

Nov 1, 2016

Begins

Nov 1, 2017

Discovered

Jan 10, 2018

Filed

vs. sector median

on median

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_099c15f6a06ff51a2018-01-10Verified
Massachusetts State AGbd_2005ee438da6d1d92018-01-10Verified

Name: Alton Lane Inc.
norm: alton lane
Domain: altonlane.com

Name: Alton Lane Inc.
norm: alton lane
Domain: altonlane.com
Industry: Retail & Consumerllm

Discovered: Nov 1, 2017
Breach occurred: Nov 1, 2016 – Nov 1, 2017
Undetected for: 365 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2018
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Removal of the malicious code from our database
Further securing the current e-commerce checkout process
Hiring a third party security agency to assist and audit our systems
Enhancing procedures to maximize the security of our IT infrastructure and systems
Changes made: Further securing the current e-commerce checkout process
Enhancing procedures to maximize the security of our IT infrastructure and systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJan 10 · first

Massachusetts State AGJan 10 · first

Montana State AGJan 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Alton-Lane.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2018
Raw hash: 62c213a12422960b805e0d2820d95bed03e47cd9797ac9e6924ac7db95e13625

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAlton Lane Inc.

Victim entityAlton Lane Inc.

Incidentdiscovered Nov 1, 2017

Stated responseRemoval of the malicious code from our database

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov