HackingTransportation & LogisticsTransportationStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Roberts Hawaii, Inc.

bd_66739fb592ffa41b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 5, 2017

Filed

Feb 24, 2017

To disclose

7 weeks

Affected

1,178state residents only

Linked

6 filings

Confidence

71%

Full breach record for Roberts Hawaii, Inc. →

Roberts Hawaii notified the Washington AG of a cyberattack where unauthorized access to web servers allowed installation of code to copy customer checkout data (names, payment card numbers, CVVs) from July 2015 to Dec 2016. 1,178 WA residents affected. Incident contained; forensic firm engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 525 days

discovery → filing · 7 weeks / 50 days

Jul 30, 2015

Begins

Jan 5, 2017

Discovered

Feb 24, 2017

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_0f8179c9d95507582017-02-24Verified
California State AGbd_1705743d3a4f02d22017-02-24Candidate
Oregon State AGbd_4a738531f1679e572017-02-24Verified
Montana State AGbd_ee905eb40fcf64a92017-02-24Verified

Show 1 more filing ↓

New Hampshire State AGbd_f3c0ea15f984ce7d2017-02-24Verified

Name: Roberts Hawaii, Inc.
norm: roberts hawaii

Name: Roberts Hawaii, Inc.
norm: roberts hawaii
Industry: Transportation & Logisticsllm

Discovered: Jan 5, 2017
Breach occurred: Jul 30, 2015 – Dec 14, 2016
Undetected for: 525 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 24, 2017
Affected individuals: 1,178state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a leading cyber security firm to examine their website network
Stopped the incident
Removed the unauthorized code
Established a dedicated call center
Changes made: Taking steps to further strengthen the security of its websites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 24 · first

California State AGFeb 24 · first

Oregon State AGFeb 24 · first

Montana State AGFeb 24 · first

New Hampshire State AGFeb 24 · first

Washington State AGFeb 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9671.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2017
Raw hash: ec14e958ae654d2e709b3493a79b876d901af95fb1f83e157b9beaa8c0ed2c45

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityRoberts Hawaii, Inc.

Victim entityRoberts Hawaii, Inc.

Incidentdiscovered Jan 5, 2017

Stated responseEngaged a leading cyber security firm to examine their website network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com