HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

Stiletto Solutions

bd_770a3b0e19e3f8b6 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 28, 2015

To disclose

—

Affected

6state residents only

Linked

3 filings

Confidence

65%

Full breach record for Stiletto Solutions →

Stiletto Solutions notified customers of unauthorized access to its e-Commerce server affecting credit/debit card data (numbers, CVV, expiration) and potentially usernames/passwords. The incident spanned Nov 1, 2013 to Sept 16, 2015. The company engaged forensic investigators, revised security protocols, and migrated payment data to a third-party processor.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2013

Begins

Oct 28, 2015

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_c3302a5f6680c50d2015-10-29 · +1dVerified
Massachusetts State AGbd_ebd1f517f3f705232015-11-03 · +6dVerified

Name: Stiletto Solutions
norm: stiletto solutions
Domain: stilettosolutions.com

Name: Stiletto Solutions
norm: stiletto solutions
Domain: stilettosolutions.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 1, 2013 – Sep 16, 2015
Materiality determined: —
Notification sent: Nov 2, 2015
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Montana Office of Consumer Protection
Initial access: exploit_public_facing

During the incident: Engaged forensic investigators and IT security advisors
Revised security protocols
Relocated payment card data to new server systems
Stopped storing payment card data locally
Migrated all customer payment card data to a third-party processor
Changes made: Relocated payment card data to new server systems
No longer storing any payment card data locally
All customer payment card data is now securely stored by our third-party processor
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 28 · first · this page

California State AG+1d

Massachusetts State AG+6d

Pattern: first filing Oct 28 (MT), last Nov 3 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Stiletto-Solutions.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2015
Raw hash: 75b21d74131341f5439f07e63dde926898fb2e7d64ebf8f70000219a88e5f0c8

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityStiletto Solutions

Victim entityStiletto Solutions

IncidentUnauthorized Access

Stated responseEngaged forensic investigators and IT security advisors

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov