HackingTechnologyRetail & ConsumerInformationStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)LowResolved

SCUF Gaming International, LLC

bd_66893d75999c2fb3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 16, 2021

Filed

Oct 21, 2021

To disclose

31 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for SCUF Gaming International, LLC →3 incidents on file

SCUF Gaming International, LLC disclosed that login credentials for a third-party vendor were used to insert an unauthorized script onto its webstore backend between February 3 and March 16, 2021. The script was detected and removed on March 16, 2021. Investigation determined the script could capture credit card information (cardholder name, email, billing address, card number, expiration, CVV) from transactions processed via credit card. PayPal transactions were not compromised. The company engaged forensic specialists and enhanced security protocols.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 16, 2021 → Notified Jul 21, 2021127d ✗ CA 60-day late31 weeks discovery → filing

Incident timeline

undetected · 41 days

discovery → filing · 31 weeks / 219 days

Feb 3, 2021

Begins

Mar 16, 2021

Discovered

Oct 21, 2021

Filed

vs. sector median

+13 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_2465f9982711a8fc2021-10-21Verified by operator
Oregon State AGbd_8127be01cc3c5cee2021-10-21Verified by operator
Maine State AGbd_bb5a520c3878a1882021-10-21Verified by operator
Massachusetts State AGbd_f398ae058ab7329b2021-10-21Verified

Show 1 more filing ↓up to 17d gap

Montana State AGbd_706a74ae76c269452021-10-04 · +17dCandidate

Name: SCUF Gaming International, LLC
norm: scuf gaming
Domain: scufgaming.com

Name: SCUF Gaming International, LLC
norm: scuf gaming
Domain: scufgaming.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Mar 16, 2021
Breach occurred: Feb 3, 2021 – Mar 16, 2021
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2021
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input Capture
Threat actor: External
Third party: via third-party vendor
Initial access: trusted_relationship

During the incident: Removed the unauthorized script immediately on March 16, 2021
Conducted a rigorous investigation in partnership with third-party forensic specialists
Continuously improve our security protocols
Increasing the scrutiny of our third-party vendors
Continuing to work with third-party forensics experts to prevent future incidents
Changes made: Regularly screen activity on our website
Enhance our security features to defend against security threats
Increasing the scrutiny of our third-party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(219 days from discovery to filing)
Compliance flags: CA 60-day late · 127d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 16, 2021
→ Notified: Jul 21, 2021
127d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 16, 2021 → Notified: Jul 21, 2021	127d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 4 · first

Washington State AG+17d

Oregon State AG+17d

Maine State AG+17d

Massachusetts State AG+17d

California State AG+17d · this page

Pattern: first filing Oct 4 (MT), last Oct 21 (CA) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-546737
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2021
Raw hash: 06b06249b741090293d332f5f24abae56a386282288634597ed8d74fcd88b9ef

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySCUF Gaming International, LLC

Victim entitySCUF Gaming International, LLC

Incidentdiscovered Mar 16, 2021

Stated responseRemoved the unauthorized script immediately on March 16, 2021

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov