HackingStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedPIIPCIIDENTITY_BASICLowContained

West Music

bd_8bdbf4f87d6d6cea · schema v1 · pii pii-v1

West Music Company notified California regulators of a data breach involving its third-party payment processor, Aptos. Unauthorized access occurred between February 2016 and December 2016, affecting payment card information (card numbers, expiration dates, names, addresses, emails) for transactions made on westmusic.com and percussionsource.com. The incident was discovered on February 6, 2017, after law enforcement requested a deferral of disclosure. West Music established a call center for affected customers.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

bd_59c8c534f685fa21Montana State AGfiled 2017-03-03Candidate
bd_a420cc4322dee7acOregon State AGfiled 2017-03-03Verified
bd_f500fe7fe6afa249Washington State AGfiled 2017-03-06(3d gap)Verified

Source provenance

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66705
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2017
Raw hash: fcb2de6612514399285f9e0c840aacc06dd0b5e6818e5a8a0e1d836dd5d0e446

Reporting entity

Name: West Music
norm: west music

Victim entity

Name: West Music
norm: west music

Incident

Discovered: Feb 6, 2017
Materiality determined: Feb 6, 2017
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPCIIDENTITY_BASIC
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: supply_chain

Compliance

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.