HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsLowContained

ALPS Brands

bd_66c0368738e99a57 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 25, 2021

Filed

Apr 5, 2021

To disclose

6 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

63%

Full breach record for ALPS Brands →

Active Lifestyle Products & Services, Inc. (ALPS Brands) disclosed a data breach affecting its e-commerce websites. An unknown third party unlawfully accessed the systems and installed a malicious program (skimmer) to capture credit card transaction data, including names, email addresses, mailing addresses, credit card numbers, expiration dates, and CVV codes. The malware was installed as early as April 20, 2020, but the incident was discovered on February 25, 2021. ALPS engaged a service provider to investigate, disabled affected systems, and implemented additional security measures. No SSNs or PHI were involved.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 25, 2021 → Notified Apr 5, 202139d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 311 days

discovery → filing · 6 weeks / 39 days

Apr 20, 2020

Begins

Feb 25, 2021

Discovered

Apr 5, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_9931ba86ec02c7e62021-04-05Verified
Massachusetts State AGbd_08e0b713a66e8be92021-04-07 · +2dVerified
New Hampshire State AGbd_4adb70742bec95572021-03-29 · +7dVerified by operator
Indiana State AGbd_e7306052c9f90adb2021-03-26 · +10dVerified by operator

Show 1 more filing ↓up to 12d gap

Maine State AGbd_d55440a81309efa32021-03-24 · +12dCandidate

Name: ALPS Brands
norm: alps brands
Domain: alpsbrands.com

Name: ALPS Brands
norm: alps brands
Domain: alpsbrands.com
Also named: Active Lifestyle Products & Services, Inc.dba oflegal entity
as ALPS Brandsdba oftrade name
Industry: Retail & Consumerllm

Discovered: Feb 25, 2021
Breach occurred: Apr 20, 2020
Undetected for: 311 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Working with the applicable governmental officials
Initial access: exploit_public_facing

During the incident: Engaged a service provider to investigate the issue
Affected systems were immediately disabled
Conducted an investigation to determine if any customer information had been compromised
Technology systems have been secured and restored to working order
Working with the applicable governmental officials to ensure the incident is properly reported and addressed
Changes made: Implementing additional security measures designed to prevent a recurrence of such an attack
Review and secure the system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: CA 60-day OK · 39d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 25, 2021
→ Notified: Apr 5, 2021
39d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 25, 2021 → Notified: Apr 5, 2021	39d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGMar 24 · first

Indiana State AG+2d

New Hampshire State AG+5d

Montana State AG+12d

California State AG+12d · this page

Massachusetts State AG+14d

Pattern: first filing Mar 24 (ME), last Apr 7 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539708
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 5, 2021
Raw hash: 9c8c103f08d6a6c37233175ad8685f9379deb6de8cc90b7f8570ddd774afbe8f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityALPS Brands

Victim entityALPS Brands

Incidentdiscovered Feb 25, 2021

Stated responseEngaged a service provider to investigate the issue

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov