HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Metabolic Maintenance Products, Inc.

bd_598facb0d98549ca · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 16, 2021

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Metabolic Maintenance Products, Inc. →4 incidents on file

Metabolic Maintenance Products, Inc. disclosed that an unknown third party installed malicious code on its website between May 2020 and July 2021, capturing transaction data including names, addresses, and payment card numbers. The company engaged forensic investigators, removed the code, and notified law enforcement and credit card brands. Affected individuals include residents of California and Rhode Island.

J jump to incidentP pin to compareR raw source

Incident timeline

May 1, 2020

Begins

Sep 16, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_02657066f49b5ed72021-09-16Verified
Montana State AGbd_1c1326d9cd7e560f2021-09-16Candidate
Maine State AGbd_a85bb19664898a7c2021-09-16Verified

Name: Metabolic Maintenance Products, Inc.
norm: metabolic maintenance products

Name: Metabolic Maintenance Products, Inc.
norm: metabolic maintenance products
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 1, 2020 – Jul 9, 2021
Materiality determined: —
Notification sent: Aug 20, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Engaged a forensic security firm to conduct an in-depth investigation
Removed the unauthorized code from our website
Notified the credit card brands and law enforcement regarding the incident
Changes made: Nearing completion of a new, state-of-the-art website
Updated firewall configuration
Increased logging
Implemented traffic detection
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 16 · first

Montana State AGSep 16 · first

Maine State AGSep 16 · first

California State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-545415
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: b21c84782355d7f8bbcde4c942b9f3f5c7690effb711f31a73ffcbaaea768950

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMetabolic Maintenance Products, Inc.

Victim entityMetabolic Maintenance Products, Inc.

IncidentUnauthorized Access

Stated responseEngaged a forensic security firm to conduct an in-depth investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov