UnknownRetail & ConsumerRetailCustomer Data InvolvedFinancial accountFinancial credentialsMediumContained

Lancaster Archery Supply

bd_4b140d91990b59ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2019

Filed

Apr 26, 2019

To disclose

23 days

Affected

3,366state residents only

Linked

6 filings

Confidence

66%

Full breach record for Lancaster Archery Supply →2 incidents on file

Lancaster Archery Supply, Inc. reported that payment card information (cardholder name, card number, expiration date, CVV) used on its websites may have been compromised between July 4, 2018, and February 16, 2019. The company became aware of the incident on April 3, 2019, after receiving a report of unusual card activity. Approximately 3,366 California residents were affected. The company engaged forensic investigators and law enforcement, remediated the issue, and enhanced security.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 3, 2019 → Notified Apr 25, 201922d ✓ CA 60-day OK23 days discovery → filing

Incident timeline

undetected · 273 days

discovery → filing · 23 days

Jul 4, 2018

Begins

Apr 3, 2019

Discovered

Apr 26, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_41719e6a459d7f012019-04-26Candidate
Oregon State AGbd_5473aaec2d7b5b522019-04-26Verified
Montana State AGbd_e5e8f0d9c4537b732019-04-26Verified by operator
Massachusetts State AGbd_9664906585832b852019-04-29 · +3dVerified

Show 1 more filing ↓up to 4d gap

New Hampshire State AGbd_0e9a99a2690ca5bc2019-04-30 · +4dVerified

Name: Lancaster Archery Supply
norm: lancaster archery supply
Domain: lancasterarchery.com

Name: Lancaster Archery Supply
norm: lancaster archery supply
Domain: lancasterarchery.com
Industry: Retail & Consumerllm

Discovered: Apr 3, 2019
Breach occurred: Jul 4, 2018 – Feb 16, 2019
Undetected for: 273 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 25, 2019
Affected individuals: 3,366state-resident count only
Data types: Financial accountFinancial credentials
Attack vector: Unknown
Regulator citations: Provided written notice of this incident to other state regulators as necessary

During the incident: Commenced an internal investigation
Worked with a third-party forensic investigator
Worked with law enforcement
Worked with credit card processor to determine the nature and scope of this event
Continued working with payment card processor to identify potentially impacted cards
Provided potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Provided written notice of this incident to other state regulators as necessary
Changes made: Remediated the issue
Enhanced security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: CA 60-day OK · 22d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 3, 2019
→ Notified: Apr 25, 2019
22d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 3, 2019 → Notified: Apr 25, 2019	22d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGApr 26 · first

Oregon State AGApr 26 · first

Montana State AGApr 26 · first

California State AGApr 26 · first · this page

Massachusetts State AG+3d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-146707
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 26, 2019
Raw hash: dd0c1c226978451599bb612e57b2d620a8cc760721763e1e3c0f7175fce69bf8

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLancaster Archery Supply

Victim entityLancaster Archery Supply

Incidentdiscovered Apr 3, 2019

Stated responseCommenced an internal investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov