MalwareRetail & ConsumerRetailRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Financial accountLowContained

Vapour Organic Beauty, LLC

bd_862b2e07740e8860 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 9, 2017

Filed

Mar 8, 2017

To disclose

27 days

Affected

114state residents only

Linked

3 filings

Confidence

66%

Full breach record for Vapour Organic Beauty, LLC →

Vapour Organic Beauty, LLC notified Montana residents of a third-party data breach involving its ecommerce platform provider, Aptos. Attackers deployed malware on Aptos' servers between Feb 2016 and Dec 2016, accessing customer PII and payment card data. Notification was delayed at law enforcement's request. AllClear ID provided identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 374 days

discovery → filing · 27 days

Feb 1, 2016

Begins

Feb 9, 2017

Discovered

Mar 8, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_4917600bc03c62dd2017-03-10 · +2dVerified
Washington State AGbd_9eba9cfbf83acd1a2017-02-25 · +11dCandidate

Name: Vapour Organic Beauty, LLC
norm: vapour organic beauty

Name: Vapour Organic Beauty, LLC
norm: vapour organic beauty
Industry: Retail & Consumerllm

Discovered: Feb 9, 2017
Breach occurred: Feb 1, 2016 – Dec 31, 2016
Undetected for: 374 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 114state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Aptos contacted Federal law enforcement agencies and the U.S. Department of Justice
Third party: via Aptos
Initial access: supply_chain

During the incident: Law enforcement requested that notification to businesses and customers be delayed to allow the investigation to move forward
Aptos worked with a leading cybersecurity firm to remove the malware from its systems
Aptos is actively monitoring the platform to safeguard personal information
Arranged to have AllClear ID protect your identity for months at no cost to you
Changes made: Aptos worked with a leading cybersecurity firm to remove the malware from its systems
Aptos is actively monitoring the platform to safeguard personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGFeb 25 · first

Montana State AG+11d · this page

Oregon State AG+13d

Pattern: first filing Feb 25 (WA), last Mar 10 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Vapour-Organic-Beauty-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2017
Raw hash: d770fb38f33ae41b4e8a08cf09bfd97d5d6420393d4fb85885b6b86add09deb4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityVapour Organic Beauty, LLC

Victim entityVapour Organic Beauty, LLC

Incidentdiscovered Feb 9, 2017

Stated responseLaw enforcement requested that notification to businesses and customers be delayed to allow the investigation to move forward

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov