HackingRetail & ConsumerTechnologyRetailDelayed DiscoveryCustomer Data InvolvedAuthenticationFinancial accountFinancial credentialsHealth (basic)Identity (basic)PHIMediumContained

Eye Buy Direct, Inc.

bd_7af7bf0034986af6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2019

Filed

Oct 15, 2019

To disclose

19 weeks

Affected

17,031state residents only

Linked

8 filings

Confidence

69%

Full breach record for Eye Buy Direct, Inc. →4 incidents on file

Eye Buy Direct, Inc. notified Washington AG of a security incident affecting 17,031 state residents. Intrusions were detected in June 2019 following reports of credit card fraud. The breach window spanned September 2018 to September 2019. Investigators could not confirm data access, but notified customers who purchased during the window. Data potentially exposed included PII, prescription info, and payment card details. Remediation included forensic review and security updates.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 273 days

discovery → filing · 19 weeks / 136 days

Sep 1, 2018

Begins

Jun 1, 2019

Discovered

Oct 15, 2019

Filed

vs. sector median

+12 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_f7922d53c8b8d8ea2019-10-14 · +1dCandidate
California State AGbd_2dbee8db03d2d89a2019-10-18 · +3dVerified
Oregon State AGbd_479cc9f8956ffdb92019-10-18 · +3dVerified
Delaware State AGbd_ab73d0fb5b5e82c72019-10-11 · +4dVerified

Show 3 more filings ↓up to 10d gap

New Hampshire State AGbd_4d69fd0e904ac3332019-10-21 · +6dVerified
Massachusetts State AGbd_67d0b2ac62d9274f2019-10-22 · +7dVerified
South Carolina State AGbd_46a4f5831a19fa742019-10-25 · +10dVerified

Name: Eye Buy Direct, Inc.
norm: eye buy direct
Domain: eyebuydirect.com

Name: Eye Buy Direct, Inc.
norm: eye buy direct
Domain: eyebuydirect.com
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Jun 1, 2019
Breach occurred: Sep 1, 2018 – Sep 28, 2019
Undetected for: 273 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2019
Affected individuals: 17,031state-resident count only
Data types: AuthenticationFinancial accountFinancial credentialsHealth (basic)Identity (basic)PHI
Data elements: NameFinancial account numberMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 300-399d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General's Office
Initial access: exploit_public_facing

During the incident: Retained the services of a respected cyber risk management firm with expertise in digital forensics
Retained the services of an independent cyber security firm to help review and update security protections
Validated all data flows into and out of our systems
Ensured that there were no unauthorized modifications to the software platform
Addressed the incident and corrected identified weaknesses
Undertook significant investments to further consolidate the security of its platform
Mailed notification to potentially affected Washington residents
Offered one-year of free identity theft monitoring and repair services through Experian
Changes made: Reviewed and updated security protections across all systems
Corrected identified weaknesses
Invested in consolidating the security of its platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(136 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Delaware State AGOct 11 · first

Montana State AG+3d

Washington State AG+4d · this page

California State AG+7d

Oregon State AG+7d

New Hampshire State AG+10d

Massachusetts State AG+11d

South Carolina State AG+14d

Pattern: first filing Oct 11 (DE), last Oct 25 (SC) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10514.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2019
Raw hash: 94b47085cafb90fa2485afb1bd68edaab187523817aa946948bdb092e2ada064

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityEye Buy Direct, Inc.

Victim entityEye Buy Direct, Inc.

Incidentdiscovered Jun 1, 2019

Stated responseRetained the services of a respected cyber risk management firm with expertise in digital forensics

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com