HackingRetail & ConsumerRetailSQL InjectionData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Hi-Tec Sports USA, Inc.

bd_63639b0edb1ea9d1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 11, 2016

Filed

May 11, 2016

To disclose

9 weeks

Affected

104state residents only

Confidence

65%

Hi-Tec Sports USA, Inc. notified Montana residents of a payment card skimming incident on its Magnum Boots online store. Unauthorized code was inserted into the order page between Sept 2014 and Jan 2016, capturing names, addresses, and full payment card details including CVVs. The company engaged forensic investigators and removed the malicious code.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 537 days

discovery → filing · 9 weeks / 61 days

Sep 21, 2014

Begins

Mar 11, 2016

Discovered

May 11, 2016

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed104 affectedView incident

Name: Hi-Tec Sports USA, Inc.
norm: hi-tec sports

Name: Hi-Tec Sports USA, Inc.
norm: hi-tec sports
Industry: Retail & Consumerllm

Discovered: Mar 11, 2016
Breach occurred: Sep 21, 2014 – Jan 23, 2016
Undetected for: 537 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2016
Affected individuals: 104state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Stopped accepting payment cards on its site
Engaged a leading computer security investigation firm to assist in the investigation
Removal of the code
Development of a new ecommerce website
Changes made: Removal of the code
Development of a new ecommerce website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Hi-Tec2.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2016
Raw hash: 13c58cea9f2bac4b7e453b96d34f6c1d625adb325fbe79103f64b3954709a631

Reporting entityHi-Tec Sports USA, Inc.

Victim entityHi-Tec Sports USA, Inc.

Incidentdiscovered Mar 11, 2016

Stated responseStopped accepting payment cards on its site

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov