HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Kathmandu UK Limited

bd_4bc4c846aa4351ab · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 18, 2019

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for Kathmandu UK Limited →

Kathmandu UK Limited notified Montana of a data breach affecting online customers who made purchases between January 8, 2019 and February 12, 2019. An unidentified third party gained unauthorized access to the website, potentially capturing billing/shipping info, credit/debit card details, and Summit Club login credentials. The company engaged external cybersecurity consultants and reset affected passwords.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 8, 2019

Begins

Mar 18, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Kathmandu UK Limited
norm: kathmandu uk
Domain: kathmanduoutdoor.com

Name: Kathmandu UK Limited
norm: kathmandu uk
Domain: kathmanduoutdoor.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 8, 2019 – Feb 12, 2019
Materiality determined: —
Notification sent: Mar 19, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Providing notice to all relevant US authorities
Initial access: exploit_public_facing

During the incident: Took immediate steps to confirm that our online store and our wider IT environment was secure
Working closely with leading external IT and Cyber Security consultants to fully investigate the circumstances of the incident
Reset Kathmandu Summit Club passwords for customers who did not reset after 12 February 2019
Providing notice to all relevant US authorities
Changes made: Ensured ongoing security of systems to help prevent this type of incident occurring again in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-MT-Notice-of-Data-Event-3.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2019
Raw hash: e38a39a765d9cc89f99af70d8bf60a3d6a7fb365fc3dea8d89562cce5c324b90

Reporting entityKathmandu UK Limited

Victim entityKathmandu UK Limited

IncidentUnauthorized Access

Stated responseTook immediate steps to confirm that our online store and our wider IT environment was secure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov