MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Vapour Organic Beauty, LLC

bd_9eba9cfbf83acd1a · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Feb 25, 2017

To disclose

17 weeks

Affected

847state residents only

Linked

3 filings

Confidence

68%

Full breach record for Vapour Organic Beauty, LLC →

Vapour Organic Beauty, LLC notified Washington AG of a breach affecting 847 state residents. Attackers placed malware on third-party provider Aptos' servers between Feb-Dec 2016, accessing names, addresses, phone numbers, and payment card data. Aptos engaged forensic investigators, removed malware, and cooperated with the FBI/DOJ. Customers were notified in Feb 2017 and offered 12 months of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 249 days

discovery → filing · 17 weeks / 116 days

Feb 26, 2016

Begins

Nov 1, 2016

Discovered

Feb 25, 2017

Filed

vs. sector median

+7 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_862b2e07740e88602017-03-08 · +11dVerified
Oregon State AGbd_4917600bc03c62dd2017-03-10 · +13dVerified

Name: Vapour Organic Beauty, LLC
norm: vapour organic beauty

Name: Vapour Organic Beauty, LLC
norm: vapour organic beauty
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 26, 2016 – Dec 5, 2016
Undetected for: 249 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 9, 2017
Affected individuals: 847state-resident count only
Data types: Identity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Reported to the FBI and the U.S. Department of JusticeLaw enforcement requested delay in notification to allow investigation to move forward
Initial access: exploit_public_facing

During the incident: Aptos worked with a leading cybersecurity firm to remove the malware from its systems
Aptos made security updates to the systems, including strengthening access controls
Aptos reported the matter to the FBI and the U.S. Department of Justice
Aptos provided Individual Consumer contact information to affected Retailers
Vapour Organic Beauty arranged for AllClear ID to protect identity for 12 months at no cost
Changes made: Strengthening access controls
Removing malware from systems
Actively monitoring the platform to safeguard personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGFeb 25 · first · this page

Montana State AG+11d

Oregon State AG+13d

Pattern: first filing Feb 25 (WA), last Mar 10 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9678.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2017
Raw hash: ae22815984c851c79e32ae9d138f7f58eaea642f7d0bc0848d8fb3fe28a91e53

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityVapour Organic Beauty, LLC

Victim entityVapour Organic Beauty, LLC

Incidentdiscovered Nov 1, 2016

Stated responseAptos worked with a leading cybersecurity firm to remove the malware from its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com