HackingRetail & ConsumerRetailSkimmerCapture App DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountFinancial credentialsPIIPCILowContained

STEIN MART, INC.

bd_8a74ba926b9e0e7f · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 13, 2018

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

78%

Full breach record for STEIN MART, INC. →3 incidents on file

Stein Mart, Inc. notified customers of a web skimmer incident involving their third-party vendor Annex Cloud. Unauthorized code was added to Annex Cloud's login integration on steinmart.com and could have captured checkout information including name, address, email, payment card number, expiration date, and CVV during multiple periods between December 28, 2017 and July 9, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 28, 2017

Begins

Nov 13, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Part of Social Annex, Inc. supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_7be7408ca16516132018-11-13Candidate
Washington State AGbd_dcd4b744c73963962018-11-13Verified by operator
Oregon State AGbd_f55c7eaa8530a3af2018-11-13Verified by operator
New Hampshire State AGbd_fb11207da2b13acd2018-11-14 · +1dVerified

Show 1 more filing ↓up to 14d gap

California State AGbd_f29c876cc79bf6702018-11-27 · +14dCandidate

Name: STEIN MART, INC.
norm: stein mart

Name: STEIN MART, INC.
norm: stein mart
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Dec 28, 2017 – Jul 9, 2018
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsPIIPCI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified California Attorney General
Third party: via Annex Cloud
Initial access: supply_chain

During the incident: Removed Annex Cloud's code from our website
Mailed letters to those customers to let them know what occurred
Sought additional information from Annex Cloud to determine the transactions that might be involved
Removed the Annex Cloud login feature from our website while the investigation is ongoing
Changes made: Removed the Annex Cloud login feature from our website to help prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGNov 13 · first

Washington State AGNov 13 · first

Oregon State AGNov 13 · first

California State AGNov 13 · first · this page

New Hampshire State AG+1d

California State AG+14d

Pattern: first filing Nov 13 (MT), last Nov 27 (CA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141776
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2018
Raw hash: 5d980584047ef86f147a2368d004913aeb0fa8c156694cdbf1a8d11d5a8dfb25

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTEIN MART, INC.

Victim entitySTEIN MART, INC.

IncidentThird-Party / Supply Chain

Stated responseRemoved Annex Cloud's code from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov