MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedPCIFinancial accountLowContained

A.D. Starr

bd_4bc4159fc6772f06 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2022

Filed

May 23, 2022

To disclose

16 weeks

Affected

4state residents only

Linked

2 filings

Confidence

65%

Full breach record for A.D. Starr →

A.D. Starr notified Montana residents of a security incident involving malicious software on its vendor's payment processing server. Cardholder data (names, card numbers, CVV, expiration) submitted between Sept 18, 2020, and Feb 3, 2022, may have been compromised. The vendor blocked the malware, engaged forensic experts, and notified law enforcement and card brands. Affected individuals were offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 501 days

discovery → filing · 16 weeks / 111 days

Sep 18, 2020

Begins

Feb 1, 2022

Discovered

May 23, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_a58ec0697d14f9ff2022-05-25 · +2dVerified

Name: A.D. Starr
norm: ad starr
Domain: adstarr.com

Name: A.D. Starr
norm: ad starr
Domain: adstarr.com
Industry: Retail & Consumerllm

Discovered: Feb 1, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 501 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2022
Affected individuals: 4state-resident count only
Data types: PCIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported the incident to federal law enforcement authorities
Initial access: supply_chain

During the incident: The vendor immediately blocked the malicious software
Retained outside data security experts to conduct a forensic investigation
Reported the incident to major card brands (VISA, MasterCard, etc.)
Reported the incident to federal law enforcement authorities
Payment processing functions of the A.D. Starr website have been subject to a thorough security review
Offering a complimentary one-year membership of Experian’s® IdentityWorksSM
Changes made: Payment processing functions of the A.D. Starr website have been subject to a thorough security review to ensure the malicious software was removed
Any necessary additional security safeguards are implemented for the payment processing functions of the website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(111 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGMay 23 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-349.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2022
Raw hash: 6a8bd2c55222e557a53fc2786c11aee2a97507651d7438b7def7fc5d5d20e1b9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityA.D. Starr

Victim entityA.D. Starr

Incidentdiscovered Feb 1, 2022

Stated responseThe vendor immediately blocked the malicious software

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov