HackingRetail & ConsumerRetailCustomer Data InvolvedFinancial accountIdentity (basic)PIILowContained

KontrolFreek

bd_9ae7edbf6506b099 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 30, 2016

Filed

Aug 22, 2016

To disclose

8 weeks

Affected

625state residents only

Linked

7 filings

Confidence

71%

Full breach record for KontrolFreek →

KontrolFreek, LLC reported a cybersecurity incident where an unauthorized third party accessed servers and acquired payment card information. The incident occurred between October 21, 2015, and April 7, 2016. KontrolFreek discovered the breach on June 30, 2016, and notified approximately 625 Washington residents. Affected data included names, addresses, payment card numbers, and security codes. The company engaged forensic experts and offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 253 days

discovery → filing · 8 weeks / 53 days

Oct 21, 2015

Begins

Jun 30, 2016

Discovered

Aug 22, 2016

Filed

vs. sector median

on median

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_17189e43559b8a922016-08-22Verified
Oregon State AGbd_cf157cf9ce275b6f2016-09-16 · +25dVerified
New Hampshire State AGbd_2e02eba102e0dd162016-06-30 · +53dVerified
Montana State AGbd_f587613c91f479912016-06-30 · +53dVerified

Show 2 more filings ↓up to 53d gap

California State AGbd_ff526db0fd9e26102016-06-30 · +53dCandidate
Massachusetts State AGbd_ff9dc73652a2eee42016-06-30 · +53dVerified

Name: KontrolFreek
norm: kontrolfreek

Name: KontrolFreek
norm: kontrolfreek
Industry: Retail & Consumerllm

Discovered: Jun 30, 2016
Breach occurred: Oct 21, 2015 – Apr 7, 2016
Undetected for: 253 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 30, 2016
Affected individuals: 625state-resident count only
Data types: PIIFinancial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Took steps to secure its website
Retained a data security expert to conduct a forensic investigation
Began notifying affected customers
Arranged to offer these residents identity protection services for one year at no cost to them
Changes made: Secured its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

New Hampshire State AGJun 30 · first

Montana State AGJun 30 · first

California State AGJun 30 · first

Massachusetts State AGJun 30 · first

Montana State AG+53d

Washington State AG+53d · this page

Oregon State AG+78d

Pattern: first filing Jun 30 (NH), last Sep 16 (OR) — a 78-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9639.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2016
Raw hash: c632c491c24af3012f74e7cfcd9914912ece8adb5ac0e52ecfcbc7aa18194c3e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityKontrolFreek

Victim entityKontrolFreek

Incidentdiscovered Jun 30, 2016

Stated responseTook steps to secure its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com