MalwareRetail & ConsumerRetailInfostealerData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Ballistic Products, Inc.

bd_6af97512dc8d42cb · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2022

Filed

Sep 5, 2022

To disclose

6 weeks

Affected

431state residents only

Linked

8 filings

Confidence

64%

Full breach record for Ballistic Products, Inc. →

Ballistic Products, Inc. issued a supplemental notice regarding a third-party vendor malware incident. Malware on the vendor's servers captured payment card data, names, and billing addresses from customers who shopped between Sept 18, 2020, and Feb 3, 2022. The vendor removed the malware and engaged forensic experts. Ballistic is offering credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 676 days

discovery → filing · 6 weeks / 41 days

Sep 18, 2020

Begins

Jul 26, 2022

Discovered

Sep 5, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_cc0ec26377c09de62022-09-03 · +2dCandidate
California State AGbd_0a9e5025b2e7d8d82022-09-09 · +4dVerified
Indiana State AGbd_ee76c2033e23652f2022-09-01 · +4dVerified
Maine State AGbd_aaecbad195251dcd2022-09-13 · +8dVerified

Show 3 more filings ↓up to 16d gap

Oregon State AGbd_c6b9c657e9d72d472022-09-13 · +8dVerified
New Hampshire State AGbd_4e5f71d683ca579d2022-09-21 · +16dVerified
Massachusetts State AGbd_ea262a4f9f55c5612022-09-21 · +16dVerified

Name: Ballistic Products, Inc.
norm: ballistic products

Name: Ballistic Products, Inc.
norm: ballistic products
Industry: Retail & Consumerllm

Discovered: Jul 26, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 676 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2022
Affected individuals: 431state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Incident reported to law enforcement
Initial access: supply_chain

During the incident: Reported incident to law enforcement
Vendor identified and removed malware
Vendor blocked unauthorized activity
Engaged data security experts for investigation
Offering identity theft protection services through IDX
Changes made: Offering 12 months/24 months of credit and CyberScan monitoring
Providing $1,000,000 insurance reimbursement policy
Providing fully managed id theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGSep 1 · first

Washington State AG+2d

Montana State AG+4d · this page

California State AG+8d

Maine State AG+12d

Oregon State AG+12d

New Hampshire State AG+20d

Massachusetts State AG+20d

Pattern: first filing Sep 1 (IN), last Sep 21 (MA) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-544.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2022
Raw hash: 5ab145c199f0c936ca27744c53869ff5e9c8f1dd8529ae56db3c2f8c112785ef

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityBallistic Products, Inc.

Victim entityBallistic Products, Inc.

Incidentdiscovered Jul 26, 2022

Stated responseReported incident to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov