HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

TradeMotion

bd_9e989badeef93617 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 25, 2018

To disclose

—

Affected

195state residents only

Linked

7 filings

Confidence

66%

Full breach record for TradeMotion →

TradeMotion notified Montana residents of a data breach affecting its website Parts.com. Between October 2017 and May 2018, unauthorized individuals used compromised credentials to extract personal and payment card information. TradeMotion engaged in investigation, secured systems, and offered one year of LifeLock identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 1, 2017

Begins

Jul 25, 2018

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_6ca2d644b949b91b2018-07-25Verified
California State AGbd_8cadac9ae90af58f2018-07-25Verified
Oregon State AGbd_bb5f8841d8f2c4a82018-07-25Verified by operator
Washington State AGbd_d50bce35ca137fd02018-07-25Verified

Show 2 more filings ↓up to 5d gap

New Hampshire State AGbd_8c236218146c5d062018-07-24 · +1dVerified
South Carolina State AGbd_b2930eee6e889a432018-07-30 · +5dVerified

Name: TradeMotion
norm: trademotion
Domain: trademotion.app

Name: TradeMotion
norm: trademotion
Domain: trademotion.app
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Oct 1, 2017 – May 31, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 195state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Conducted an investigation of this incident
Deactivating unused accounts
Resetting certain passwords
Minimizing access to personal information
Re-engineering the process in which payment information is collected and stored
Retained LifeLock to provide one (1) year of complimentary identity protection services
Changes made: Re-engineering the process in which payment information is collected and stored
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGJul 24 · first

Massachusetts State AG+1d

California State AG+1d

Oregon State AG+1d

Washington State AG+1d

Montana State AG+1d · this page

South Carolina State AG+6d

Pattern: first filing Jul 24 (NH), last Jul 30 (SC) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/TradeMotion.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2018
Raw hash: a3211780b74bfad2ef3d8af81bdec5f6680526aca216016529c9f0ad256dada8

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTradeMotion

Victim entityTradeMotion

IncidentUnauthorized Access

Stated responseConducted an investigation of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov