HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedPIIPCIIdentity (basic)LowContained

West Music

bd_8bdbf4f87d6d6cea · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 6, 2017

Filed

Mar 3, 2017

To disclose

25 days

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for West Music →3 incidents on file

West Music Company notified California regulators of a data breach involving its third-party payment processor, Aptos. Unauthorized access occurred between February 2016 and December 2016, affecting payment card information (card numbers, expiration dates, names, addresses, emails) for transactions made on westmusic.com and percussionsource.com. The incident was discovered on February 6, 2017, after law enforcement requested a deferral of disclosure. West Music established a call center for affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 371 days

discovery → filing · 25 days

Feb 1, 2016

Begins

Feb 6, 2017

Discovered

Mar 3, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_59c8c534f685fa212017-03-03Candidate
New Hampshire State AGbd_761fbaedfa112ed72017-03-03Verified
Oregon State AGbd_a420cc4322dee7ac2017-03-03Verified
Washington State AGbd_f500fe7fe6afa2492017-03-06 · +3dVerified

Name: West Music
norm: west music
Domain: westmusic.com

Name: West Music
norm: west music
Domain: westmusic.com
Industry: Retail & Consumerllm

Discovered: Feb 6, 2017
Breach occurred: Feb 1, 2016 – Dec 31, 2016
Undetected for: 371 daysoccurrence → discovery
Materiality determined: Feb 6, 2017
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPCIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Engaged a cybersecurity firm to help contain and eliminate the issue
Contacted the FBI Cyber Division and the U.S. Department of Justice
Established a call center specifically to help answer any questions
Changes made: Blocked the method of unauthorized access
Removed malware from the Aptos system
Actively monitoring the system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 3 · first

New Hampshire State AGMar 3 · first

Oregon State AGMar 3 · first

California State AGMar 3 · first · this page

Washington State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66705
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2017
Raw hash: fcb2de6612514399285f9e0c840aacc06dd0b5e6818e5a8a0e1d836dd5d0e446

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWest Music

Victim entityWest Music

Incidentdiscovered Feb 6, 2017

Stated responseEngaged a cybersecurity firm to help contain and eliminate the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov