HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowContained
titlenine.com
bd_6fae6ea2118fad49 · schema v1 · pii pii-v1
Full breach record for titlenine.com →Title Nine Sports, Inc. notified California AG that third-party vendor Annex Cloud deployed unauthorized code on its checkout system between Dec 28, 2017 and July 9, 2018. The code captured customer names, addresses, payment card numbers, expiration dates, and CVVs. Title Nine removed the application and notified affected customers.
California clockDiscovered Oct 25, 2018 → Notified Oct 25, 20180d ✓ CA 60-day OK18 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-141744
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 12, 2018
- Raw hash
- 781c0830b5d0874d1e720e8a6c10bc439965678a819cd3f1e569400e7fe2c464
Reporting entity
- Name
- titlenine.comnorm: titleninecom
- Domain
- titlenine.com
Victim entity
- Name
- titlenine.comnorm: titleninecom
- Domain
- titlenine.com
Incident
- Discovered
- Oct 25, 2018
- Materiality determined
- —
- Notification sent
- Oct 25, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1056 Input Capture
- Threat actor
- External
- Third party
- via Annex Cloud
- Initial access
- supply_chain
Compliance
- Time to disclose
- 18 days(18 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 25, 2018→ Notified: Oct 25, 20180d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.