MalwareRetail & ConsumerTechnologyRetailCapture App DataCustomer Data InvolvedData ExfiltratedPCIIdentity (basic)Financial accountLowActive

Datapak Services

bd_89f1f4964aabfd61 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 8, 2013

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

70%

Full breach record for Datapak Services →2 incidents on file

Datapak Services Corporation, an order fulfillment and payment processor for e-commerce websites, discovered malware placed on its systems on March 5, 2013, potentially enabling unauthorized access to customer credit card information including name, address, primary account number, expiration date, and card security code. The investigation was ongoing at time of notification. Affected individuals were offered one year of identity protection services through AllClearID.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 5, 2013

Begins

Nov 8, 2013

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_32d8425b7a2ea35b2013-11-06 · +2dVerified
Massachusetts State AGbd_407b88eb1a00689b2013-10-07 · +32dVerified
New Hampshire State AGbd_eef09eeeb380ffad2013-10-02 · +37dVerified

Name: Datapak Services
norm: datapak services
Domain: datapakservices.com

Name: Datapak Services
norm: datapak services
Domain: datapakservices.com
Industry: Retail & ConsumerllmTechnologyllm

Discovered: —
Breach occurred: Mar 5, 2013
Materiality determined: —
Notification sent: Nov 11, 2013
Affected individuals: Not disclosed
Data types: PCIIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1059 Command and Scripting InterpreterT1005 Data from Local System
Threat actor: ExternalFinancial
Regulator citations: Notified California Attorney General per SB 24

During the incident: Immediately contained and secured the potentially affected parts of the system
Launched an internal investigation
Retained independent, third-party security experts
Took steps to further contain and secure the potentially affected parts of the system
Cooperating with the credit card companies and law enforcement
Engaged AllClearID to provide one (1) year of identity protection services to affected individuals
Established a call center to assist affected individuals with questions regarding the security incident
Changes made: Engaged independent, third-party security experts to review and secure affected systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 2 · first

Massachusetts State AG+5d

New Hampshire State AG+35d

California State AG+37d · this page

Pattern: first filing Oct 2 (NH), last Nov 8 (CA) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-43227
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2013
Raw hash: 32191957c606cfbe91b66b8af11f3c689f6902b4f004e475ac406c61e20dd742

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDatapak Services

Victim entityDatapak Services

IncidentUnauthorized Access

Stated responseImmediately contained and secured the potentially affected parts of the system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov