MalwareRetail & ConsumerRetailRansomwareData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedPIIFinancial accountIdentity (basic)MediumContained

Wilson's Gun Shop, Inc.

bd_89ede39eb8479a80 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 26, 2022

Filed

Sep 12, 2022

To disclose

7 weeks

Affected

3,788state residents only

Linked

9 filings

Confidence

70%

Full breach record for Wilson's Gun Shop, Inc. →

Wilson's Gun Shop Inc. d/b/a Wilson Combat disclosed a third-party breach involving its payment processor, FreeStyle Software Inc. Malware on FreeStyle's servers exposed customer PII and payment card data for transactions made between Sept 17, 2020 and Feb 3, 2022. 3,788 Washington residents were identified as affected. The breach was discovered on July 26, 2022.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 677 days

discovery → filing · 7 weeks / 48 days

Sep 17, 2020

Begins

Jul 26, 2022

Discovered

Sep 12, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_2c579e94ac98d0622022-09-12Verified
Indiana State AGbd_862ffcc2719d1df82022-09-08 · +4dVerified
Massachusetts State AGbd_ab80f8ec246c150f2022-09-08 · +4dVerified
California State AGbd_f28ec71a19f624532022-09-08 · +4dVerified

Show 4 more filings ↓up to 5d gap

Maine State AGbd_1a99362a85e71f0b2022-09-07 · +5dVerified by operator
Montana State AGbd_3b3e41a18cf934942022-09-07 · +5dVerified
Oregon State AGbd_6f3f1d835a29e9612022-09-07 · +5dVerified
South Carolina State AGbd_ff435776ec107f5b2022-09-07 · +5dVerified

Name: Wilson's Gun Shop, Inc.
norm: wilson s gun shop
Domain: wilsoncombat.com

Name: Wilson's Gun Shop, Inc.
norm: wilson s gun shop
Domain: wilsoncombat.com
Also named: Wilson's Gun Shop Inc.dba oflegal entity
Wilson Combatdba oftrade name
Industry: Retail & Consumerllm

Discovered: Jul 26, 2022
Breach occurred: Sep 17, 2020 – Feb 3, 2022
Undetected for: 677 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2022
Affected individuals: 3,788state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: State and federal law enforcement authorities have been notified of the breach
Third party: via FreeStyle Software Inc.
Initial access: supply_chain

During the incident: FreeStyle immediately had it removed and took steps to block any further unauthorized activity
Retained data security experts to investigate the breach
State and federal law enforcement authorities have been notified of the breach
Coordinating with the payment card companies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Maine State AGSep 7 · first

Montana State AGSep 7 · first

Oregon State AGSep 7 · first

South Carolina State AGSep 7 · first

Indiana State AG+1d

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+5d

Washington State AG+5d · this page

Pattern: first filing Sep 7 (ME), last Sep 12 (WA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM13825.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2022
Raw hash: 056e6b04e363bb265aaa447f97bbc6755750222dc5457be1f18cd143abb91515

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityWilson's Gun Shop, Inc.

Victim entityWilson's Gun Shop, Inc.

Incidentdiscovered Jul 26, 2022

Stated responseFreeStyle immediately had it removed and took steps to block any further unauthorized activity

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com