HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)CredentialsFinancial accountMediumContained

VF Outlet

bd_8080a1d4eadad826 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 28, 2016

To disclose

—

Affected · nationwide

7,28412 in this filing

Confidence

66%

Full breach record for VF Outlet →

VF Outlet, Inc. notified Montana and other state AGs of a data breach where an unauthorized individual accessed a third-party server hosting vfoutlet.com between April 17 and August 26, 2016. The incident exposed personal information, including names, addresses, emails, passwords, and payment card data, for 7,284 individuals. VF Outlet resolved the vulnerability and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 17, 2016

Begins

Sep 28, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7,284 affectedView incident

Name: VF Outlet
norm: vf outlet
Domain: vfoutlet.com

Name: VF Outlet
norm: vf outlet
Domain: vfoutlet.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Apr 17, 2016 – Aug 26, 2016
Materiality determined: —
Notification sent: Sep 28, 2016
Affected individuals: 7,284state + nationwide
Data types: PIIIdentity (basic)CredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Resolved the vulnerability
Implemented measures to help prevent incidents of this kind in the future
Arranged for complimentary credit monitoring service for one year through Equifax
Engaged Equifax to provide Equifax Credit Watch Gold with WebDetect
Changes made: Resolved the vulnerability
Implemented measures to help prevent incidents of this kind in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/VF-Outlet.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 28, 2016
Raw hash: 6b4491cb027913d88e0c87803910d001e208e9661d7b3592a41c978790f0e8b7

Reporting entityVF Outlet

Victim entityVF Outlet

IncidentUnauthorized Access

Stated responseResolved the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov