HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

Hi-Tec Sports USA, Inc.

bd_52584b5ad4cac9a4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 11, 2016

Filed

Apr 29, 2016

To disclose

7 weeks

Affected

9state residents only

Confidence

65%

Hi-Tec Sports USA, Inc. notified Montana residents of a breach affecting online orders placed between Jan 24 and Mar 11, 2016. Unauthorized code on the order page captured PII and payment card data (including CVV). The company engaged forensic investigators, removed the code, and launched a new site.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 47 days

discovery → filing · 7 weeks / 49 days

Jan 24, 2016

Begins

Mar 11, 2016

Discovered

Apr 29, 2016

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: Hi-Tec Sports USA, Inc.
norm: hi-tec sports

Name: Hi-Tec Sports USA, Inc.
norm: hi-tec sports
Industry: Retail & Consumerllm

Discovered: Mar 11, 2016
Breach occurred: Jan 24, 2016 – Mar 11, 2016
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2016
Affected individuals: 9state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Stopped accepting payment cards on its site
Engaged a leading computer security investigation firm to assist in the investigation
Removal of the code
Development of a new e-commerce website
Changes made: Development of a new e-commerce website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Hi-Tec.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2016
Raw hash: d8d2520c6a2e087253e4c7805af767f4ac8caf5efb4d295f700d83b47fae51da

Reporting entityHi-Tec Sports USA, Inc.

Victim entityHi-Tec Sports USA, Inc.

Incidentdiscovered Mar 11, 2016

Stated responseStopped accepting payment cards on its site

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov