HackingRetail & ConsumerRetailStolen CredentialsTargetedData ExfiltratedPIIIdentity (basic)Financial accountCredentialsLowContained

Aeroflow Inc.

bd_70d3dac0694535f3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 20, 2019

Filed

May 17, 2019

To disclose

8 weeks

Affected

16state residents only

Linked

4 filings

Confidence

65%

Full breach record for Aeroflow Inc. →2 incidents on file

Aeroflow Inc. notified customers that unauthorized code injected into its checkout page between September 6, 2018, and March 27, 2019, exfiltrated payment card data and PII. The company retained a cybersecurity firm for investigation and enhanced security monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 195 days

discovery → filing · 8 weeks / 58 days

Sep 6, 2018

Begins

Mar 20, 2019

Discovered

May 17, 2019

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_a8dd378297c491662019-05-17Verified
HHS OCRbd_abad8947e923d13d2019-05-16 · +1dVerified
New Hampshire State AGbd_7f1388e5eb3d757a2019-05-20 · +3dVerified

Name: Aeroflow Inc.
norm: aeroflow
Domain: cheapcpapsupplies.com

Name: Aeroflow Inc.
norm: aeroflow
Domain: cheapcpapsupplies.com
Industry: Retail & Consumerllm

Discovered: Mar 20, 2019
Breach occurred: Sep 6, 2018 – Mar 27, 2019
Undetected for: 195 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2019
Affected individuals: 16state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Retained a leading cyber security firm to investigate the incident
Changes made: Taking aggressive steps to address website security
Enhancing system monitoring to help reduce risk
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRMay 16 · first

Massachusetts State AG+1d

Montana State AG+1d · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notice-11.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2019
Raw hash: 237bc10f4022261b4a3d37586a29886508bbea7ab741231943cb3c65de007939

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAeroflow Inc.

Victim entityAeroflow Inc.

Incidentdiscovered Mar 20, 2019

Stated responseRetained a leading cyber security firm to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov