HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedPIIFinancial accountIdentity (basic)MediumContained

Easy Breathe, Inc.

bd_6a25382414ceb30b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 10, 2017

Filed

Mar 31, 2017

To disclose

7 weeks

Affected

1,419state residents only

Linked

6 filings

Confidence

65%

Full breach record for Easy Breathe, Inc. →

Easy Breathe, Inc. notified customers that an unknown individual accessed credit/debit card information used for online purchases. The incident was discovered on February 10, 2017. Affected data included names, addresses, phone numbers, and payment card details. No health information was involved. The company engaged IT experts, secured the website, and offered 12 months of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due7 weeks discovery → filing

Incident timeline

discovery → filing · 7 weeks / 49 days

Feb 10, 2017

Discovered

Mar 31, 2017

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_0ffdb705de61caaf2017-03-27 · +4dVerified
Oregon State AGbd_30f914a5f01ddc412017-03-27 · +4dCandidate
New Hampshire State AGbd_9a18ddc515f7c1912017-03-27 · +4dVerified
Massachusetts State AGbd_c6c8a59de40209412017-03-27 · +4dVerified

Show 1 more filing ↓up to 4d gap

Washington State AGbd_f6e58d89ec9258c12017-03-27 · +4dVerified

Name: Easy Breathe, Inc.
norm: easy breathe

Name: Easy Breathe, Inc.
norm: easy breathe
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Materiality determined: —
Notification sent: Mar 27, 2017
Affected individuals: 1,419state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took action to secure our system
Commenced an investigation
Engaged IT experts who have assisted us in securing our website
Addressed possible vulnerabilities
Implemented continuous security monitoring of our website
Arranged to have AllClear ID protect your identity for 12 months at no cost to you
Changes made: Addressed possible vulnerabilities
Implemented continuous security monitoring of our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 27 · first

Oregon State AGMar 27 · first

New Hampshire State AGMar 27 · first

Massachusetts State AGMar 27 · first

Washington State AGMar 27 · first

South Carolina State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/EasyBreatheInc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2017
Raw hash: e84fb2a5a9782b75109a8ab23d1e55ce9535d625957201231f50ffbf79ff4fc9

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityEasy Breathe, Inc.

Victim entityEasy Breathe, Inc.

Incidentdiscovered Feb 10, 2017

Stated responseTook action to secure our system

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov