HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Bellacor.com, Inc.

bd_94c734474dd42759 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2012

Filed

Aug 21, 2012

To disclose

26 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Bellacor.com, Inc. →

Bellacor.com, Inc. disclosed that an unauthorized third party injected malicious code into its website around June 7, 2012, gaining unlawful access to temporary data files used for e-commerce transactions. The code was discovered and contained on July 26, 2012. Affected data included customer names, addresses, phone numbers, and encrypted credit card numbers with security codes. Bellacor is offering one year of credit monitoring and identity theft resolution services to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 49 days

discovery → filing · 26 days

Jun 7, 2012

Begins

Jul 26, 2012

Discovered

Aug 21, 2012

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_cf4b40503899d2de2012-08-23 · +2dVerified

Name: Bellacor.com, Inc.
norm: bellacorcom

Name: Bellacor.com, Inc.
norm: bellacorcom
Industry: Retail & Consumerllm

Discovered: Jul 26, 2012
Breach occurred: Jun 7, 2012 – Jul 26, 2012
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Discovered and contained malicious code on July 26th
Mounted an aggressive investigation into the circumstances surrounding the situation
Working with the appropriate authorities
Conducted a review of our own internal security and training
Offering one year of credit monitoring, a credit report, ongoing educational materials, and resolution services through Identity Theft 911
Changes made: Removing the malicious code
Modifying relevant procedures and processes on our website
Implementing additional security procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGAug 21 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-32569
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2012
Raw hash: 158153719072df4c458c0834c4f26579d93c0548c1037d9010efba36a73976df

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBellacor.com, Inc.

Victim entityBellacor.com, Inc.

Incidentdiscovered Jul 26, 2012

Stated responseDiscovered and contained malicious code on July 26th

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov