HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedFINANCIAL_ACCOUNTPIILowContained

Thesy, LLC

bd_9789e69f395e9d05 · schema v1 · pii pii-v1

Thesy, LLC disclosed a data breach affecting its e-commerce platform. A third-party intruder inserted malicious code between December 6, 2017, and June 27, 2018, potentially accessing customer credit card information. The breach was contained on June 27, 2018. Thesy notified law enforcement and provided one year of complimentary LifeLock identity theft monitoring to affected customers. No evidence of actual misuse was found at the time of notification.

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

bd_29827fb2026f3f0eOregon State AGfiled 2018-12-05(7d gap)Verified by operator
bd_85c323663de55ed7Washington State AGfiled 2018-11-09(19d gap)Verified by operator
bd_7490611cf71add4dHawaii State AGfiled 2018-11-08(20d gap)Verified
bd_4be8278075b406a1Montana State AGfiled 2018-11-05(23d gap)Candidate

Source provenance

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142197
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2018
Raw hash: eae5634e96172727c7dfe49258cbf12b6b53ad6e7bf465d2d51e06025e69b08a

Reporting entity

Name: Thesy, LLC
norm: thesy

Victim entity

Name: Thesy, LLC
norm: thesy

Incident

Discovered: Sep 20, 2018
Materiality determined: Nov 2, 2018
Notification sent: —
Affected individuals: Not disclosed
Data types: FINANCIAL_ACCOUNTPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

Compliance

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.