HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedPIIFinancial accountIdentity (basic)LowContained

Atlantic Cigar Co.

bd_458ad445b06a55e7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2017

Filed

Feb 28, 2017

To disclose

18 days

Affected

477state residents only

Linked

5 filings

Confidence

65%

Full breach record for Atlantic Cigar Co. →3 incidents on file

Atlantic Cigar Co. notified customers of a data breach involving its third-party payment processor, Aptos. In November 2016, Aptos detected compromise and delayed notification for investigation. On Feb 10, 2017, Atlantic Cigar learned of remote access intrusion exposing customer names, addresses, and payment card data. Remediation included malware removal and 12-month identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 101 days

discovery → filing · 18 days

Nov 1, 2016

Begins

Feb 10, 2017

Discovered

Feb 28, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_b5772fa0842b7d7b2017-02-27 · +1dCandidate
Washington State AGbd_5e4ce0ba9672f6992017-03-08 · +8dVerified
New Hampshire State AGbd_90a3f7720b4cfc2e2017-03-08 · +8dVerified
Oregon State AGbd_7fae23b7ae3326182017-03-09 · +9dVerified

Name: Atlantic Cigar Co.
norm: atlantic cigar

Name: Atlantic Cigar Co.
norm: atlantic cigar
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Breach occurred: Nov 1, 2016
Undetected for: 101 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 477state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported its suspicions to U.S. law enforcement agencies
Initial access: external_remote_services

During the incident: Aptos has worked with a leading cybersecurity firm to remove the malware from and update the security of its systems
Strengthening access controls
Atlantic Cigar Co. has arranged to have AllClear ID protect your identity for 12 months at no cost to you
Changes made: Update the security of its systems
Strengthening access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGFeb 27 · first

South Carolina State AG+1d · this page

Washington State AG+9d

New Hampshire State AG+9d

Oregon State AG+10d

Pattern: first filing Feb 27 (MT), last Mar 9 (OR) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/AptosInc(Atlantic%20Cigar).pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2017
Raw hash: e660bddd464e623ff22ca599c0c4ed9d8d4d3b8b7be1597e72f3faba1e725674

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAtlantic Cigar Co.

Victim entityAtlantic Cigar Co.

Incidentdiscovered Feb 10, 2017

Stated responseAptos has worked with a leading cybersecurity firm to remove the malware from and update the security of its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov