HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Ketterer Company

bd_62d9408976ba9403 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2020

Filed

Jun 24, 2020

To disclose

17 weeks

Affected

19state residents only

Linked

3 filings

Confidence

64%

Full breach record for Ketterer Company →

Ketterer Company notified customers of a data security incident involving malicious scripting on KnightsGear.com from Feb 7 to May 6, 2020. The script harvested names, addresses, emails, and payment card details (including CVV). Ketterer detected the issue on Feb 24, 2020, engaged forensic investigators, and closed the store. Notices were sent June 23, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 17 weeks / 121 days

Feb 7, 2020

Begins

Feb 24, 2020

Discovered

Jun 24, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6feb7e7a980416582020-06-24Verified
Indiana State AGbd_be446f03142529aa2020-06-23 · +1dVerified

Name: Ketterer Company
norm: ketterer

Name: Ketterer Company
norm: ketterer
Industry: Retail & Consumerllm

Discovered: Feb 24, 2020
Breach occurred: Feb 7, 2020 – May 6, 2020
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 23, 2020
Affected individuals: 19state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a digital forensics firm to help determine what happened
Closed the online store in response to COVID-19 social distancing measures
Added additional safeguards to minimize the chance that an incident like this could occur in the future
Changes made: Added additional safeguards to minimize the chance that an incident like this could occur in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(121 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 23 · first

Massachusetts State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2020
Raw hash: 4f7aa48dd9b8c60e1ee418e7499e0a5056b713235fa6f54f4c9bb19b0b80e63c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKetterer Company

Victim entityKetterer Company

Incidentdiscovered Feb 24, 2020

Stated responseEngaged a digital forensics firm to help determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov