Social EngineeringRetail & ConsumerRetailPhishingTargetedPIIIdentity (basic)Government IDEmploymentHighContained

Advance Auto Parts, Inc.

bd_413e38d96c01b2a1 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 7, 2016

Filed

Mar 17, 2016

To disclose

10 days

Affected

3,067state residents only

Linked

6 filings

Confidence

65%

Full breach record for Advance Auto Parts, Inc. →2 incidents on file

Advance Auto Parts notified employees of a phishing attack on March 7, 2016, where an attacker posed as an internal employee to trick a staff member into providing a file containing PII (name, SSN, wages, tax state) of 2015 employees. Advance notified federal law enforcement, engaged AllClear ID for 24 months of identity protection, and issued notices on March 17, 2016.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due10 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 days

Mar 7, 2016

Begins

Mar 7, 2016

Discovered

Mar 17, 2016

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_3cce9ac72fde297a2016-03-17Verified
California State AGbd_9cbe6906ec7bb21c2016-03-16 · +1dVerified
Massachusetts State AGbd_bda8f85a7b59f0f02016-03-16 · +1dVerified
Washington State AGbd_fd971bcf70ef33ed2016-03-15 · +2dCandidate

Show 1 more filing ↓up to 28d gap

Oregon State AGbd_061f86f700c416db2016-04-14 · +28dVerified

Name: Advance Auto Parts, Inc.
norm: advance auto parts

Name: Advance Auto Parts, Inc.
norm: advance auto parts
Industry: Retail & Consumerllm

Discovered: Mar 7, 2016
Breach occurred: Mar 7, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2016
Affected individuals: 3,067state-resident count only
Data types: PIIIdentity (basic)Government IDEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: phishing_link

During the incident: Notified federal law enforcement of this incident, requesting that they investigate fully
Communicating to all relevant current and former employees
Offering free identity protection services and hotline support
Engaged AllClear ID to provide identity protection services for 24 months
Changes made: Assess any additional actions needed to protect our employee information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGMar 15 · first

California State AG+1d

Massachusetts State AG+1d

Montana State AG+2d

South Carolina State AG+2d · this page

Oregon State AG+30d

Pattern: first filing Mar 15 (WA), last Apr 14 (OR) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2016/AdvancedAutoParts.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2016
Raw hash: af5d22ced4213f379c392f062e88f981438005d8835a56f3ec93e815b0f395de

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAdvance Auto Parts, Inc.

Victim entityAdvance Auto Parts, Inc.

Incidentdiscovered Mar 7, 2016

Stated responseNotified federal law enforcement of this incident, requesting that they investigate fully

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov