HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataTargetedData ExfiltratedFinancial accountIdentity (basic)PCIMediumContained

Thesy, LLC

bd_85c323663de55ed7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 20, 2018

Filed

Nov 9, 2018

To disclose

7 weeks

Affected

5,907state residents only

Linked

7 filings

Confidence

70%

Full breach record for Thesy, LLC →2 incidents on file

Thesy, LLC, an e-commerce retailer, notified Washington AG of a breach affecting 5,907 residents. Unauthorized access occurred Dec 2017–Jun 2018 via malicious code in shopping cart software. Credit card data was at risk. Discovered Sep 2018. Notices sent Nov 2018 offering LifeLock services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 288 days

discovery → filing · 7 weeks / 50 days

Dec 6, 2017

Begins

Sep 20, 2018

Discovered

Nov 9, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Hawaii State AGbd_7490611cf71add4d2018-11-08 · +1dVerified
Montana State AGbd_4be8278075b406a12018-11-05 · +4dCandidate
Massachusetts State AGbd_a654dc30bc88fe802018-11-26 · +17dVerified
South Carolina State AGbd_a79d1e1cca6e8f732018-11-26 · +17dVerified

Show 2 more filings ↓up to 26d gap

California State AGbd_9789e69f395e9d052018-11-28 · +19dVerified
Oregon State AGbd_29827fb2026f3f0e2018-12-05 · +26dVerified by operator

Name: Poole & Shaffery, LLP
norm: poole shaffery

Name: Thesy, LLC
norm: thesy
Domain: elementvape.com
Industry: Retail
Industry: Retail & Consumerllm

Discovered: Sep 20, 2018
Breach occurred: Dec 6, 2017 – Jun 27, 2018
Undetected for: 288 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 2, 2018
Affected individuals: 5,907state-resident count only
Data types: PCIFinancial account
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Filed preliminary notice of potential security breach with Washington Office of Attorney General
Initial access: exploit_public_facing

During the incident: Ran a search of all consumer transactions
Implemented security patches to the shopping cart
Removed the malicious code from Thesy’s e-commerce platform
Mitigating vulnerabilities with the Website by increasing security monitoring
Notified law enforcement of the incident
Offered identity theft protection / mitigation services at no cost
Changes made: Implemented security patches to the shopping cart
Removed the malicious code from Thesy’s e-commerce platform
Mitigating vulnerabilities with the Website by increasing security monitoring along with existing SSL encryption technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGNov 5 · first

Hawaii State AG+3d

Washington State AG+4d · this page

Massachusetts State AG+21d

South Carolina State AG+21d

California State AG+23d

Oregon State AG+30d

Pattern: first filing Nov 5 (MT), last Dec 5 (OR) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10590.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2018
Raw hash: aca5e12b1a4890106283e7ca02f0035ebfda57d52266d53fe555a04082b3c9a7

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityPoole & Shaffery, LLP

Victim entityThesy, LLC

Incidentdiscovered Sep 20, 2018

Stated responseRan a search of all consumer transactions

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com