HackingRetail & ConsumerRetailVulnerability ExploitSkimmerData ExfiltratedCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

Black Phoenix Corp

bd_7dd4353854169aae · schema v1 · pii pii-v1

Severity

Low

Discovered

May 16, 2018

Filed

May 17, 2018

To disclose

≤1 day

Affected

150

Confidence

65%

Full breach record for Black Phoenix Corp →

Black Phoenix, Inc. disclosed that malicious code was injected into its checkout page between May 1 and May 16, 2018, potentially compromising credit card data for under 150 customers. The attacker created a bogus admin account. The company neutralized the code, reset passwords, moved to a new server, and notified the FBI and law enforcement.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 16, 2018 → Notified May 17, 20181d ✓ CA 60-day OK≤1 day discovery → filing

Incident timeline

undetected · 15 days

discovery → filing · ≤1 day / 1 days

May 1, 2018

Begins

May 16, 2018

Discovered

May 17, 2018

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed150 affectedView incident

Name: Black Phoenix Corp
norm: black phoenix
Domain: blackphoenixcorp.com

Name: Black Phoenix Corp
norm: black phoenix
Domain: blackphoenixcorp.com
Industry: Retail & Consumerllm

Discovered: May 16, 2018
Breach occurred: May 1, 2018 – May 16, 2018
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2018
Affected individuals: 150nationwide
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notifying the FBINotifying local law enforcement in Los Angeles, CA
Initial access: exploit_public_facing

During the incident: Initiated sitewide password reset
Neutralized malicious code
Performed full security audit
Moved site to new server with managed infrastructure
Removed fake admin account
Hardening security to ensure breaches do not occur in the future
Initiating a more robust intrusion detection system
Directly contacting the 150ish people whose credit card numbers may have been compromised
Notifying AuthorizeNet
Notifying the FBI
Notifying local law enforcement in Los Angeles, CA
Changes made: Hardening security to ensure breaches do not occur in the future
Initiating a more robust intrusion detection system
Moved site to new server with managed infrastructure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: CA 60-day OK · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 16, 2018
→ Notified: May 17, 2018
1d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 16, 2018 → Notified: May 17, 2018	1d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-136332
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2018
Raw hash: aae54fde459a232cbe0237aa461198b2f7ef5417a798e20341a0384de21d4922

Reporting entityBlack Phoenix Corp

Victim entityBlack Phoenix Corp

Incidentdiscovered May 16, 2018

Stated responseInitiated sitewide password reset

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov