MalwareTechnologyRetail & ConsumerInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoverySupply Chain (3P Vendor)Identity (basic)Financial accountMediumContained

Aptos

bd_7b839a7a8a9f571c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2016

Filed

Feb 25, 2017

To disclose

17 weeks

Affected

10,000

Linked

6 filings

Confidence

64%

Full breach record for Aptos →

Aptos, Inc., a third-party e-commerce platform provider, experienced a malware intrusion between February and December 2016, discovered in November 2016. Attackers placed malware on Aptos servers, gaining access to customer payment card data (card numbers, expiration dates) and basic PII (name, address, phone, email) for approximately 10,000 clients, including Alpha Industries. Notification was delayed by law enforcement request. Aptos engaged forensic investigators, removed malware, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 1, 2016 → Notified Feb 21, 2017112d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

undetected · 274 days

discovery → filing · 17 weeks / 116 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Feb 25, 2017

Filed

vs. sector median

+4 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_0ef30bb08f7149d82017-02-25Candidate
Massachusetts State AGbd_240674ed1319758d2017-02-27 · +2dVerified
California State AGbd_3b0817bc12a5f5cb2017-02-27 · +2dVerified
New Hampshire State AGbd_d70604f71608d8642017-03-03 · +6dVerified

Show 1 more filing ↓up to 27d gap

Oregon State AGbd_95597eac1553f5362017-03-24 · +27dCandidate

Name: Aptos
norm: aptos
Domain: aptos.com

Name: Aptos
norm: aptos
Domain: aptos.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 31, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 21, 2017
Affected individuals: 10,000nationwide
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Contacted federal law enforcementLaw enforcement requested delay in notification to allow investigation to move forward
Third party: via Aptos, Inc.
Initial access: supply_chain

During the incident: Worked with a leading cybersecurity firm to remove the malware from its systems
Actively monitoring the platform to safeguard personal information
Contacted and offered its cooperation to federal law enforcement
Steps were taken to supply the numbers of affected cards to their issuers for monitoring
Offering complimentary credit monitoring and an identity theft protection product by Equifax
Changes made: Removed malware from systems
Actively monitoring the platform
Destroyed any and all remaining client data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: CA 60-day late · 112d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 1, 2016
→ Notified: Feb 21, 2017
112d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 1, 2016 → Notified: Feb 21, 2017	112d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

New Hampshire State AGFeb 25 · first

California State AGFeb 25 · first · this page

Massachusetts State AG+2d

California State AG+2d

New Hampshire State AG+6d

Oregon State AG+27d

Pattern: first filing Feb 25 (NH), last Mar 24 (OR) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66556
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2017
Raw hash: 6a5569b6235ad05d6a19f9f6a985144cc75f7d0eaa47b8c23220d88609521f15

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAptos

Victim entityAptos

Incidentdiscovered Nov 1, 2016

Stated responseWorked with a leading cybersecurity firm to remove the malware from its systems

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov