MalwareRetail & ConsumerRetailRansomwareData EncryptedSupply Chain (3P Vendor)PIIIdentity (basic)Financial accountFinancial credentialsLowContained

shopPOPdisplays

bd_675ece26c8d2df70 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 11, 2018

To disclose

—

Affected

3state residents only

Linked

3 filings

Confidence

65%

Full breach record for shopPOPdisplays →

shopPOPdisplays, Inc. notified Montana AG of a data incident involving its Miva-hosted checkout platform. Malware was inserted between April 8 and May 14, 2018, potentially capturing credit card data and PII. shopPOPdisplays engaged forensic investigators, reset passwords, and offered one year of ID theft protection. No confirmation of actual data access was made.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 8, 2018

Begins

Jun 11, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_26063d864be221af2018-06-11Verified
Massachusetts State AGbd_d7afd99847e692492018-06-14 · +3dVerified

Name: shopPOPdisplays
norm: shoppopdisplays

Name: shopPOPdisplays
norm: shoppopdisplays
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Apr 8, 2018 – May 14, 2018
Materiality determined: —
Notification sent: Jun 11, 2018
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified consumer reporting agenciesWorking with law enforcement
Third party: via Miva Inc.
Initial access: exploit_public_facing

During the incident: Miva has removed the malware from the servers supporting our systems
We engaged a forensics firm to determine the source of the intruder's access
We have notified PayPal, Visa, Mastercard, American Express, Discover, and consumer reporting agencies
We are reviewing all policies and procedures to ensure all necessary and appropriate security measures are taken
We have required all users affected by the data incident to reset their passwords
We are working with law enforcement
Changes made: Reviewing all policies and procedures to ensure all necessary and appropriate security measures are taken to avoid any similar incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJun 11 · first

Montana State AGJun 11 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/shopPOPdisplays-Inc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2018
Raw hash: f896262f0b4750312445e0968aabc80bf07af832bebc38610f0985d400f574d6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityshopPOPdisplays

Victim entityshopPOPdisplays

IncidentThird-Party / Supply Chain

Stated responseMiva has removed the malware from the servers supporting our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov