MalwareRetail & ConsumerRetailRansomwareData ExfiltratedSupply Chain (3P Vendor)Identity (basic)Financial accountLowContained

Sport-Smart.com

bd_886a7cbbefbf83e1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Mar 8, 2017

To disclose

18 weeks

Affected

70state residents only

Confidence

64%

Full breach record for Sport-Smart.com →

Sport-Smart.com notified Montana AG of a data breach involving its third-party payment platform provider, Aptos. Malware was placed on Aptos servers between Feb 2016 and Dec 2016, compromising customer names, addresses, and payment card data. Aptos engaged a cybersecurity firm to remove malware and cooperated with law enforcement. Sport-Smart migrated to a new platform.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 18 weeks / 127 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Mar 8, 2017

Filed

vs. sector median

+11 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed70 affectedView incident

Name: Sport-Smart.com
norm: sport smartcom
Domain: sport-smart.com

Name: Sport-Smart.com
norm: sport smartcom
Domain: sport-smart.com
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 70state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Aptos contacted and offered its cooperation to federal law enforcement
Third party: via Aptos
Initial access: supply_chain

During the incident: Aptos has worked with a leading cybersecurity firm to remove the malware from its systems
Aptos is actively monitoring the platform to safeguard personal information
Aptos has contacted and offered its cooperation to federal law enforcement
Sport-Smart.com has now moved it’s site off the Aptos platform to a more secure platform
Changes made: Moved site off the Aptos platform to a more secure platform that does not store credit card data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Sport-Smart.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2017
Raw hash: 3a8f8345135ff838a5219f228f0ded12f3adf862e9ca69175f9d142402e9926e

Reporting entitySport-Smart.com

Victim entitySport-Smart.com

Incidentdiscovered Nov 1, 2016

Stated responseAptos has worked with a leading cybersecurity firm to remove the malware from its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov