HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Sears Holdings Corporation

bd_4127990c5317e1c8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 26, 2018

Filed

Apr 24, 2018

To disclose

29 days

Affected

2,373state residents only

Linked

5 filings

Confidence

68%

Full breach record for Sears Holdings Corporation →3 incidents on file

Sears Holdings notified Washington AG of a breach affecting 2,373 residents. A third-party vendor's malicious script collected names, addresses, and payment card info from customers who ordered between Sept 27 and Oct 12, 2017. Discovered March 26, 2018. Notifications sent April 25, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 180 days

discovery → filing · 29 days

Sep 27, 2017

Begins

Mar 26, 2018

Discovered

Apr 24, 2018

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_542e3870138514372018-04-24Verified
Montana State AGbd_e91e1c561709d7b72018-04-25 · +1dVerified
Oregon State AGbd_34500406ffb3c68c2018-05-17 · +23dVerified
South Carolina State AGbd_6ccd597659c183d32018-05-18 · +24dVerified

Name: Sears Holdings Corporation
norm: sears holdings

Name: Sears Holdings Corporation
norm: sears holdings
Industry: Retail & Consumerllm

Discovered: Mar 26, 2018
Breach occurred: Sep 27, 2017 – Oct 12, 2017
Undetected for: 180 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 25, 2018
Affected individuals: 2,373state-resident count only
Data types: Identity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General, State of Washington
Initial access: exploit_public_facing

During the incident: Conducted a thorough investigation of the incident
Notified the credit card companies of this incident
Cooperating with law enforcement authorities as they investigate this incident
Changes made: Vendor removed the script from its code and secured its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGApr 24 · first

Washington State AGApr 24 · first · this page

Montana State AG+1d

Oregon State AG+23d

South Carolina State AG+24d

Pattern: first filing Apr 24 (NH), last May 18 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9565.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2018
Raw hash: af24236d52e452a3c7d54c17b1d58c750a0fcbe88d3ae16c4cfa3651559158b6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySears Holdings Corporation

Victim entitySears Holdings Corporation

Incidentdiscovered Mar 26, 2018

Stated responseConducted a thorough investigation of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com