HackingRetail & ConsumerRetailStolen CredentialsSkimmerTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsMediumContained

Blade HQ

bd_58df914043b255af · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 18, 2021

Filed

Apr 19, 2021

To disclose

5 weeks

Affected

1,334state residents only

Linked

9 filings

Confidence

64%

Full breach record for Blade HQ →

Blade HQ, LLC notified customers of a data breach where unauthorized parties gained access to hosted servers via compromised admin credentials. Malicious JavaScript was uploaded to skim customer transaction data (names, addresses, credit card numbers, CVVs) between Jan 7 and Apr 11, 2021. The incident was detected on March 18, 2021. Blade HQ engaged forensic investigators, removed malware, deployed new servers, and implemented additional security measures.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 70 days

discovery → filing · 5 weeks / 32 days

Jan 7, 2021

Begins

Mar 18, 2021

Discovered

Apr 19, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_4de597f4ac5ffcf42021-04-19Candidate
California State AGbd_8a34f4aeb2a21f7e2021-04-19Verified
Washington State AGbd_981135236a66aab22021-04-19Verified
New Hampshire State AGbd_f6e497d7bc576b252021-04-19Verified

Show 4 more filings ↓up to 5d gap

Montana State AGbd_a449fbb90cda4b3e2021-04-20 · +1dVerified
Maine State AGbd_bf35a6f255d2a15b2021-04-20 · +1dVerified
Indiana State AGbd_2fbaeb6b51b0a4392021-04-21 · +2dVerified
Massachusetts State AGbd_be5281510a50cdea2021-04-24 · +5dVerified

Name: Blade HQ
norm: blade hq
Domain: bladehq.com
Industry: online retailer of outdoor equipment

Name: Blade HQ
norm: blade hq
Domain: bladehq.com
Industry: online retailer of outdoor equipment
Industry: Retail & Consumerllm

Discovered: Mar 18, 2021
Breach occurred: Jan 7, 2021 – Apr 11, 2021
Undetected for: 70 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2021
Affected individuals: 1,334state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notification of relevant state Attorney's General
Initial access: valid_credentials

During the incident: Retained the services of a qualified cybersecurity forensic investigation firm
Removed the intruder’s access and malware from our website
Deployed new servers
Implemented additional security measures
Working closely with major credit card suppliers and governmental authorities
Changes made: Patched vulnerable security vectors
Searched for and repaired any other security vulnerabilities
Created a clean and secure server and switched all operations to such clean server
Added new and increased security measures internally
Implementing a written information security policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Oregon State AGApr 19 · first

California State AGApr 19 · first

Washington State AGApr 19 · first

New Hampshire State AGApr 19 · first

South Carolina State AGApr 19 · first · this page

Montana State AG+1d

Maine State AG+1d

Indiana State AG+2d

Massachusetts State AG+5d

Pattern: first filing Apr 19 (OR), last Apr 24 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/BladeHQ.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 19, 2021
Raw hash: edf267ae79898f9942eea2e3260501b5ff83f81897f48e59f9ffbb2d218360ec

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityBlade HQ

Victim entityBlade HQ

Incidentdiscovered Mar 18, 2021

Stated responseRetained the services of a qualified cybersecurity forensic investigation firm

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov