MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

EBSCO Sign Group, Inc. (outdoorsignsamerica.com)

bd_6afd304618d0e92a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 16, 2018

To disclose

—

Affected

4state residents only

Linked

3 filings

Confidence

65%

Full breach record for EBSCO Sign Group, Inc. (outdoorsignsamerica.com) →2 incidents on file

EBSCO Sign Group, Inc. notified Montana residents of a malware intrusion on outdoorsignsamer.com between Sept 12, 2017 and May 18, 2018. The malware intercepted payment card numbers, CVVs, expiration dates, names, billing addresses, and emails. The company engaged forensic experts, removed the malware, and notified law enforcement and credit card issuers.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 12, 2017

Begins

Jul 16, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a109793f89286b8a2018-07-16Verified
New Hampshire State AGbd_c1a248b2cc9c529f2018-07-16Verified

Name: EBSCO Sign Group, Inc. (outdoorsignsamerica.com)
norm: ebsco sign group inc outdoorsignsamericacom
Domain: outdoorsignsamerica.com

Name: EBSCO Sign Group, Inc. (outdoorsignsamerica.com)
norm: ebsco sign group inc outdoorsignsamericacom
Domain: outdoorsignsamerica.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 12, 2017 – May 18, 2018
Materiality determined: —
Notification sent: Jul 15, 2018
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcementNotified credit card companies
Initial access: exploit_public_facing

During the incident: Shut down the shopping cart
Conducted an in-depth investigation
Engaged outside cybersecurity experts
Removed the malware and secured the website
Notified law enforcement and the credit card companies
Cooperating with their investigations
Directly notified customers who have been affected
Changes made: Removed malware and secured the website
Reactivated the website’s shopping cart
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 16 · first

New Hampshire State AGJul 16 · first

Montana State AGJul 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/EBSCO.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2018
Raw hash: 6952659779cd63868aa54bbb768d7e66d57c2f3c1c8de4d6b81436535f6059a3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEBSCO Sign Group, Inc. (outdoorsignsamerica.com)

Victim entityEBSCO Sign Group, Inc. (outdoorsignsamerica.com)

IncidentRansomware

Stated responseShut down the shopping cart

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov