HackingRetail & ConsumerRetailVulnerability ExploitTargetedIdentity (basic)Financial accountAuthenticationLowContained

Aetrex Worldwide, Inc.

bd_613ccc44cdf5d038 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 17, 2018

Filed

Jan 17, 2019

To disclose

4 weeks

Affected

35state residents only

Linked

4 filings

Confidence

63%

Full breach record for Aetrex Worldwide, Inc. →

Aetrex Worldwide, Inc. disclosed a data breach where an unauthorized third party inserted malicious code into its website to capture customer payment card information (names, addresses, card numbers, CVVs) between June 22 and December 4, 2018. The company hired forensic investigators, removed the code, and implemented additional security measures. Notices were sent in January 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 178 days

discovery → filing · 4 weeks / 31 days

Jun 22, 2018

Begins

Dec 17, 2018

Discovered

Jan 17, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2b52a57158abd7642019-01-17Verified
California State AGbd_a61c8c1f3ff362432019-01-17Verified
New Hampshire State AGbd_cba5a65ddb6bc7182019-01-22 · +5dVerified

Name: Aetrex Worldwide, Inc.
norm: aetrex worldwide

Name: Aetrex Worldwide, Inc.
norm: aetrex worldwide
Industry: Retail & Consumerllm

Discovered: Dec 17, 2018
Breach occurred: Jun 22, 2018 – Dec 4, 2018
Undetected for: 178 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 14, 2019
Affected individuals: 35state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notify any required state regulatorsnotify the credit reporting agencies
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Hired third-party forensic investigators
Removed the unauthorized code that led to the vulnerability
Implemented additional security measures
Changes made: Removed the unauthorized code that led to the vulnerability
Implemented additional security measures to reduce the likelihood of a similar incident from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJan 17 · first

California State AGJan 17 · first

Montana State AGJan 17 · first · this page

New Hampshire State AG+5d

Pattern: first filing Jan 17 (MA), last Jan 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Aetrex-Worldwide-Inc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2019
Raw hash: 2684594c2e785bc907cff9c7fe3904cc06f73bb9b143d88acec0a67c9e452ce7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAetrex Worldwide, Inc.

Victim entityAetrex Worldwide, Inc.

Incidentdiscovered Dec 17, 2018

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov