HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

BraceAbility, Inc.

bd_99609ca4c6c3ed30 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 28, 2016

Filed

Dec 13, 2016

To disclose

7 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for BraceAbility, Inc. →

BraceAbility, Inc. disclosed a security incident affecting its online ordering website. The company learned of the incident on October 28, 2016. Unauthorized access occurred between September 24, 2016, and November 28, 2016. Compromised data included names, addresses, credit/debit card numbers, verification codes, and expiration dates. BraceAbility engaged forensic experts, corrected the vulnerability, and offered one year of identity theft protection to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 34 days

discovery → filing · 7 weeks / 46 days

Sep 24, 2016

Begins

Oct 28, 2016

Discovered

Dec 13, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_fc8f4aff59138d3b2016-12-13Candidate

Name: BraceAbility, Inc.
norm: braceability

Name: BraceAbility, Inc.
norm: braceability
Industry: Retail & Consumerllm

Discovered: Oct 28, 2016
Breach occurred: Sep 24, 2016 – Nov 28, 2016
Undetected for: 34 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged independent IT forensic experts to assist with our investigation
Identified and corrected the vulnerability that allowed the attack
Changes made: Provided one year of Equifax Credit Watch Gold identity theft protection product at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGDec 13 · first

California State AGDec 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-65407
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2016
Raw hash: c9c528e8326ccd60181662e5e4728df77c856eb7cb50329300a89e223cd83dd3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBraceAbility, Inc.

Victim entityBraceAbility, Inc.

Incidentdiscovered Oct 28, 2016

Stated responseEngaged independent IT forensic experts to assist with our investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov