HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Financial accountFinancial credentialsMediumContained

Artifact Uprising

bd_851183810730c470 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2024

Filed

Aug 23, 2024

To disclose

23 days

Affected · nationwide

9,74053 in this filing

Linked

5 filings

Confidence

65%

Full breach record for Artifact Uprising →

SPAU Holdings, LLC d/b/a Artifact Uprising LLC disclosed a data breach affecting 9,740 individuals. Unauthorized access occurred between June 14 and July 12, 2024, via a third-party software vulnerability on their website. The incident involved the exfiltration of names, addresses, and credit card details (including CVV and expiration dates). The breach was discovered on July 31, 2024, and consumer notifications were sent on August 23, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 31, 2024 → Filed with AG Aug 23, 202423d ✓ ME AG ≤30d23 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 47 days

discovery → filing · 23 days

Jun 14, 2024

Begins

Jul 31, 2024

Discovered

Aug 23, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0e1801da246abf4b2024-08-23Verified
New Hampshire State AGbd_281f8ed31c66f50d2024-08-23Verified
Montana State AGbd_e3f9657b8d2483242024-08-23Verified
California State AGbd_151b6ab94dc3a35f2024-08-22 · +1dCandidate

Name: Artifact Uprising
norm: artifact uprising

Name: Artifact Uprising
norm: artifact uprising
Also named: SPAU Holdings, LLCdba oflegal entity
Artifact Uprising LLCdba oftrade name
Industry: Retail & Consumerllm

Discovered: Jul 31, 2024
Breach occurred: Jun 14, 2024 – Jul 12, 2024
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 23, 2024
Affected individuals: 9,740state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Immediately took action to secure our website and contain and remediate the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: ME AG ≤30d · 23d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 31, 2024
→ Filed with AG: Aug 23, 2024
23d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 31, 2024 → Filed with AG: Aug 23, 2024	23d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGAug 22 · first

Indiana State AG+1d

New Hampshire State AG+1d

Montana State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e4dbf1ec-96dd-4281-98b6-3298a2fccdac.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2024
Raw hash: 09d222c9fbfca16192adae375fa379581679f580461006568532f94dba168794

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityArtifact Uprising

Victim entityArtifact Uprising

Incidentdiscovered Jul 31, 2024

Stated responseImmediately took action to secure our website and contain and remediate the incident

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov