MisuseRetail & ConsumerRetailPrivilege AbuseEmployee Data InvolvedTargetedPIIFinancial accountIdentity (basic)LowContained

Direct Distributors, Inc

bd_8e269d2951588ed2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 9, 2019

Filed

Feb 21, 2019

To disclose

6 weeks

Affected

11state residents only

Linked

2 filings

Confidence

65%

Full breach record for Direct Distributors, Inc →

Direct Distributors, Inc. notified Montana residents that an employee accessed archived customer order forms containing names, addresses, and credit card information for orders placed prior to July 28, 2016. The employee was suspended and terminated. The company disabled the account, contacted law enforcement, and offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 895 days

discovery → filing · 6 weeks / 43 days

Jul 28, 2016

Begins

Jan 9, 2019

Discovered

Feb 21, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_08fb3de60b6ccf5d2019-02-21Verified

Name: Direct Distributors, Inc
norm: direct distributors

Name: Direct Distributors, Inc
norm: direct distributors
Industry: Retail & Consumerllm

Discovered: Jan 9, 2019
Breach occurred: Jul 28, 2016 – Jan 9, 2019
Undetected for: 895 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2019
Affected individuals: 11state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: Contacted the sheriff’s office
Initial access: insider_action

During the incident: Suspended the employee’s employment
Commenced an investigation
Contacted the sheriff’s office
Disabled the account used to access the customer order forms
Secured the services of Kroll to provide identity monitoring
Changes made: Reviewed and revised document retention policies and procedures
Further limited employee access to order information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 21 · first

Montana State AGFeb 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-Direct-Distributors-Inc.-Notice-of-Data-Security-Incident.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2019
Raw hash: 2bba9bdd457b75275e24912a89e7035aa8e303c6367fe80d3e6167ff2e093d0a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDirect Distributors, Inc

Victim entityDirect Distributors, Inc

Incidentdiscovered Jan 9, 2019

Stated responseSuspended the employee’s employment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov