HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

CJ Products Inc.

bd_6ecc3110c23e2e19 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 18, 2017

Filed

Feb 19, 2019

To disclose

22 months

Affected

Not disclosed

Confidence

64%

Full breach record for CJ Products Inc. →

CJ Products Inc. (Pillow Pets) experienced unauthorized access to its website code from a foreign IP address between August 30, 2017, and April 9, 2018. The incident was discovered on April 18, 2017, when unusual code was detected. Affected data includes customer names, addresses, and credit card numbers. The company engaged forensic investigators, removed the malicious code, and notified law enforcement and credit bureaus.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 18, 2017 → Notified Feb 15, 2019668d ✗ CA 60-day late22 months discovery → filing

Incident timeline

Aug 30, 2017

Begins

Feb 19, 2019

Filed

vs. sector median

+88 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CJ Products Inc.
norm: cj products
Domain: pillowpets.com

Name: CJ Products Inc.
norm: cj products
Domain: pillowpets.com
Industry: Retail & Consumerllm

Discovered: Apr 18, 2017
Breach occurred: Aug 30, 2017 – Apr 9, 2018
Materiality determined: —
Notification sent: Feb 15, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the applicable state agencies
Initial access: exploit_public_facing

During the incident: Hired a specialized forensic IT firm to investigate
Removed the code from the site
Implemented measures to prevent further access to customer information
Notified the local Police Department
Notified all three credit bureaus
Notified the applicable state agencies
Working with law enforcement in their investigation
Changes made: Reviewing office policies and procedures to ensure all security measures are taken to avoid such an incident from occurring again
Hired IT specialists to determine what happened and confirm the security of our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 months(672 days from discovery to filing)
Compliance flags: CA 60-day late · 668d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 18, 2017
→ Notified: Feb 15, 2019
668d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 18, 2017 → Notified: Feb 15, 2019	668d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144851
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2019
Raw hash: c24e9200187df9c8a1c65cbef5f7d52f1e2360ab5927c8d6c93803a3aaecf729

Reporting entityCJ Products Inc.

Victim entityCJ Products Inc.

Incidentdiscovered Apr 18, 2017

Stated responseHired a specialized forensic IT firm to investigate

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov