AccidentalRetail & ConsumerRetailMisconfigurationData ExfiltratedPIIIdentity (basic)Financial accountLowResolved

VEGA

bd_61bd206f0ed0b1c6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2018

Filed

Dec 5, 2018

To disclose

5 weeks

Affected

135state residents only

Confidence

66%

Full breach record for VEGA →2 incidents on file

Vega US, LLC notified Montana residents of a data incident involving malicious JavaScript on a discontinued version of its myvega.com website. The incident, detected on November 1, 2018, potentially exposed names, addresses, and credit card information. Vega engaged forensic investigators and law enforcement, and offered 24 months of free credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 34 days

Nov 1, 2018

Discovered

Dec 5, 2018

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed135 affectedView incident

Name: VEGA
norm: vega
Domain: vega-corp.com

Name: VEGA
norm: vega
Domain: vega-corp.com
Industry: Retail & Consumerllm

Discovered: Nov 1, 2018
Materiality determined: —
Notification sent: Dec 5, 2018
Affected individuals: 135state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Law enforcement has investigated this incident
Initial access: exploit_public_facing

During the incident: Retained a leading cybersecurity forensic team
Retained leading cybersecurity law firms
Engaged forensic team to investigate
Arranged to have Experian protect your identity for 24 months at no cost
Changes made: Review existing safeguards, policies, and procedures
Implement additional protections to secure further the data in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Vega.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2018
Raw hash: f2a2127a85fd8032de4f2586321cb15c7a44fcbead03f683da6a13429b7d272e

Reporting entityVEGA

Victim entityVEGA

Incidentdiscovered Nov 1, 2018

Stated responseRetained a leading cybersecurity forensic team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov