MalwareRetail & ConsumerRetailCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

DC International, Inc.

bd_5ae5f761acfa3dd5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 9, 2018

Filed

Nov 7, 2018

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for DC International, Inc. →

DC International disclosed a data security incident affecting customers of its e-commerce site, Leatherology.com. Between July 20 and September 9, 2018, previously unknown malware captured personal and credit card data (name, billing address, email, credit card number, expiration date, CVV) prior to transmission to the payment gateway. The incident was discovered on September 9, 2018. DC International removed the malicious code, engaged forensic experts and law enforcement, and offered one year of credit monitoring via Experian to affected customers.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 9, 2018 → Notified Nov 7, 201859d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 51 days

discovery → filing · 8 weeks / 59 days

Jul 20, 2018

Begins

Sep 9, 2018

Discovered

Nov 7, 2018

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_1727e4ee2a6d52bf2018-11-08 · +1dVerified
New Hampshire State AGbd_7cb51b59f4a1e88c2018-11-08 · +1dVerified
Montana State AGbd_a684ad8a1fa187362018-11-05 · +2dCandidate

Name: DC International, Inc.
norm: dc international
Domain: dcint.net

Name: DC International, Inc.
norm: dc international
Domain: dcint.net
Industry: Retail & Consumerllm

Discovered: Sep 9, 2018
Breach occurred: Jul 20, 2018 – Sep 9, 2018
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 7, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1056 Input Capture
Threat actor: ExternalFinancial

During the incident: Removed the malicious code
Notified our e-commerce platform security team
Working closely with law enforcement and IT security experts to investigate
Notifying the three major credit reporting agencies
Offering one year of free credit monitoring through Experian’s IdentityWorks product
Changes made: Continuing to probe our system for vulnerabilities
Conducted a thorough review of affected records and computer systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: CA 60-day OK · 59d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 9, 2018
→ Notified: Nov 7, 2018
59d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 9, 2018 → Notified: Nov 7, 2018	59d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 5 · first

California State AG+2d · this page

Massachusetts State AG+3d

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141582
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2018
Raw hash: ef3588c2d00b155e4f452d5b7d3d00652881b63268d8585e40f1d06a0f5b60a0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDC International, Inc.

Victim entityDC International, Inc.

Incidentdiscovered Sep 9, 2018

Stated responseRemoved the malicious code

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov