MalwareRansomwareData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)FINANCIAL_ACCOUNTPIILowContained
BlueWave Express Car Wash
bd_74b7bfe4f8e076ed · schema v1 · pii pii-v1
Full breach record for BlueWave Express Car Wash →Acme Car Wash and Clearwater Express notified the California AG of a data security incident involving its point-of-sale systems. Between February 6 and 23, 2017, malware installed by a third-party platform provider compromised customer payment card data (names, card numbers, security codes). The company worked with the provider to remove malware, implemented monitoring, and offered one year of credit monitoring via Kroll to affected customers.
California clockDiscovered Mar 27, 2017 → Notified Mar 27, 20170d ✓ CA 60-day OK14 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-67429
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 10, 2017
- Raw hash
- 8600da198088d1ea8cbe87dc517273feb763939922bce33eaa5a06eb95cfe7a4
Reporting entity
- Name
- BlueWave Express Car Washnorm: bluewave express car wash
- Domain
- bluewaveexpress.com
Victim entity
- Name
- BlueWave Express Car Washnorm: bluewave express car wash
- Domain
- bluewaveexpress.com
Incident
- Discovered
- Mar 27, 2017
- Materiality determined
- —
- Notification sent
- Mar 27, 2017
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Time to disclose
- 14 days(14 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 27, 2017→ Notified: Mar 27, 20170d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.