HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Active Lifestyle Products & Services, Inc

bd_9931ba86ec02c7e6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 25, 2021

Filed

Apr 5, 2021

To disclose

6 weeks

Affected

100state residents only

Linked

6 filings

Confidence

66%

Full breach record for Active Lifestyle Products & Services, Inc →

Active Lifestyle Products & Services, Inc. (ALPS) notified customers of a data breach where an unknown third party installed malicious software on its e-commerce websites between April 2020 and February 2025. The malware captured credit card numbers, expiration dates, CVVs, names, addresses, and emails. ALPS disabled affected systems, engaged forensic investigators, and secured its technology. No SSNs or PHI were involved.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 311 days

discovery → filing · 6 weeks / 39 days

Apr 20, 2020

Begins

Feb 25, 2021

Discovered

Apr 5, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_66c0368738e99a572021-04-05Verified
Massachusetts State AGbd_08e0b713a66e8be92021-04-07 · +2dVerified
New Hampshire State AGbd_4adb70742bec95572021-03-29 · +7dVerified by operator
Indiana State AGbd_e7306052c9f90adb2021-03-26 · +10dVerified by operator

Show 1 more filing ↓up to 12d gap

Maine State AGbd_d55440a81309efa32021-03-24 · +12dCandidate

Name: Active Lifestyle Products & Services, Inc
norm: active lifestyle products
Domain: alpsbrands.com

Name: Active Lifestyle Products & Services, Inc
norm: active lifestyle products
Domain: alpsbrands.com
Industry: Retail & Consumerllm

Discovered: Feb 25, 2021
Breach occurred: Apr 20, 2020
Undetected for: 311 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2021
Affected individuals: 100state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Working with applicable governmental officials to ensure the incident is properly reported and addressed
Initial access: exploit_public_facing

During the incident: Engaged a service provider to investigate the issue
Affected systems were immediately disabled
Conducted an investigation of the issue
Technology systems have since been secured and restored to working order
Engaged a service provider to review and secure the system
Implementing additional security measures
Working with applicable governmental officials
Changes made: Implementing additional security measures designed to prevent a recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGMar 24 · first

Indiana State AG+2d

New Hampshire State AG+5d

California State AG+12d

Montana State AG+12d · this page

Massachusetts State AG+14d

Pattern: first filing Mar 24 (ME), last Apr 7 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/ALPS-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 5, 2021
Raw hash: ec52bb507477dbdb56d4798f7d912edeab0f7f2576cb3cfed44d91090e69ea8d

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityActive Lifestyle Products & Services, Inc

Victim entityActive Lifestyle Products & Services, Inc

Incidentdiscovered Feb 25, 2021

Stated responseEngaged a service provider to investigate the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov