MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedPIIFinancial accountIdentity (basic)LowContained

Atlantic Cigar Co.

bd_5e4ce0ba9672f699 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2017

Filed

Mar 8, 2017

To disclose

26 days

Affected

803state residents only

Linked

5 filings

Confidence

68%

Full breach record for Atlantic Cigar Co. →3 incidents on file

Atlantic Cigar notified Washington AG of a supplemental breach involving 803 residents. A third-party provider, Aptos, suffered a malware/ransomware incident affecting customer PII and payment card data. Notification to consumers occurred on 2017-03-14.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 350 days

discovery → filing · 26 days

Feb 26, 2016

Begins

Feb 10, 2017

Discovered

Mar 8, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_90a3f7720b4cfc2e2017-03-08Verified
Oregon State AGbd_7fae23b7ae3326182017-03-09 · +1dVerified
South Carolina State AGbd_458ad445b06a55e72017-02-28 · +8dVerified
Montana State AGbd_b5772fa0842b7d7b2017-02-27 · +9dCandidate

Name: Aptos
norm: aptos
Domain: aptos.com

Name: Atlantic Cigar Co.
norm: atlantic cigar
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Breach occurred: Feb 26, 2016 – Dec 5, 2016
Undetected for: 350 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 14, 2017
Affected individuals: 803state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Aptos reported its suspicions to U.S. law enforcement agencies.
Third party: via Aptos
Initial access: supply_chain

During the incident: Aptos has worked with a leading cybersecurity firm to remove the malware from and update the security of its systems, including strengthening access controls.
Atlantic Cigar Co. has arranged to have AllClear ID protect your identity for 12 months at no cost to you.
Changes made: Strengthening access controls.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGFeb 27 · first

South Carolina State AG+1d

New Hampshire State AG+9d

Washington State AG+9d · this page

Oregon State AG+10d

Pattern: first filing Feb 27 (MT), last Mar 9 (OR) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9685.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2017
Raw hash: d2b36861f6efe571455440d44b5cbd28f2ab9d106c218aababe8835ccc7eaadd

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAptos

Victim entityAtlantic Cigar Co.

Incidentdiscovered Feb 10, 2017

Stated responseAptos has worked with a leading cybersecurity firm to remove the malware from and update the security of its systems, including strengthening access controls.

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com