MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)PIILowContained

San Antonio Shoemakers, Inc.

bd_87b68431c9c9ac10 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 8, 2016

Filed

Jul 19, 2016

To disclose

6 weeks

Affected

511state residents only

Linked

5 filings

Confidence

69%

Full breach record for San Antonio Shoemakers, Inc. →

San Antonio Shoemakers, Inc. notified the Washington AG of a malware attack on checkout systems from April 21 to June 13, 2016, affecting payment card data. Discovered June 8, 2016. 511 Washington residents affected. Notified July 18, 2016. Identity monitoring provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 48 days

discovery → filing · 6 weeks / 41 days

Apr 21, 2016

Begins

Jun 8, 2016

Discovered

Jul 19, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_00729930bd488ea22016-07-19Verified
Montana State AGbd_f3f04949a1d804972016-07-19Verified
New Hampshire State AGbd_fa97a22a1ef7d5002016-07-19Verified
Massachusetts State AGbd_21cc62cab306c3082016-07-20 · +1dVerified

Name: LATHAM & WATKINS LLP
norm: latham watkins

Name: San Antonio Shoemakers, Inc.
norm: san antonio shoemakers
Industry: Retail & Consumerllm

Discovered: Jun 8, 2016
Breach occurred: Apr 21, 2016 – Jun 13, 2016
Undetected for: 48 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 18, 2016
Affected individuals: 511state-resident count only
Data types: Financial accountPII
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Bob FergusonCooperating with United States Attorney’s Office for the Southern District of New YorkCooperating with New York Electronic Crimes Task Force of the United States Secret Service

During the incident: Engaged outside cybersecurity experts to conduct an extensive investigation
Working closely with law enforcement authorities
Secured systems to ensure the malware no longer presents a threat
Notifying residents of Washington potentially affected by the attack
Changes made: Providing 24 months of identity protection at no cost to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGJul 19 · first

Montana State AGJul 19 · first

New Hampshire State AGJul 19 · first

Washington State AGJul 19 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9634.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2016
Raw hash: 9b91020887fec2772e987488a347e37e41e3e40144867937cbb735983af43b51

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLATHAM & WATKINS LLP

Victim entitySan Antonio Shoemakers, Inc.

Incidentdiscovered Jun 8, 2016

Stated responseEngaged outside cybersecurity experts to conduct an extensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com