HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationCredentialsFinancial accountFinancial credentialsIdentity (basic)MediumContained

PupBox

bd_a35955daeb84c799 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 2, 2020

Filed

Oct 2, 2020

To disclose

4 weeks

Affected · nationwide

30,6731,046 in this filing

Linked

8 filings

Confidence

66%

Full breach record for PupBox →

PupBox, a business unit of Petco, notified the Washington AG of a security incident affecting 1,046 WA residents (approx. 30,673 total). An unauthorized plugin on the PupBox website captured personal and financial data (names, emails, credit card numbers, CVVs, passwords) between Feb 11 and Aug 9, 2020. PupBox detected the incident on Sept 2, 2020, engaged forensic investigators, removed the plugin, and reset user passwords.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 204 days

discovery → filing · 4 weeks / 30 days

Feb 11, 2020

Begins

Sep 2, 2020

Discovered

Oct 2, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_0cff5122d7572df92020-10-02Verified
Oregon State AGbd_112e1659397ddbcd2020-10-02Candidate
New Hampshire State AGbd_1a005f6b179da35d2020-10-02Verified
Indiana State AGbd_48adbf2bc53591ee2020-10-02Verified

Show 3 more filings ↓

Montana State AGbd_94b2f1b7ca0d521f2020-10-02Verified by operator
Maine State AGbd_ac9a1da511d3b2862020-10-02Verified
California State AGbd_d9e74f7ccefc139c2020-10-02Verified

Name: PupBox
norm: pupbox
Domain: pupbox.com

Name: PupBox
norm: pupbox
Domain: pupbox.com
Industry: Retail & Consumerllm

Discovered: Sep 2, 2020
Breach occurred: Feb 11, 2020 – Aug 9, 2020
Undetected for: 204 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2020
Affected individuals: 30,673state + nationwide
Data types: Identity (basic)Financial accountFinancial credentialsCredentials
Data elements: NameFinancial account numberUnique private keyUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a leading cybersecurity firm
Removed the malicious plugin from the PupBox website
Conducted Server remediation to prevent unauthorized parties from installing malicious plugins
Logged out and reset the passwords of all users who interacted with the PupBox website between February 11, 2020 and August 9, 2020
Shut down the impacted systems to prevent unauthorized access to customer data
Partnered with cybersecurity experts to investigate the issue
Changes made: Enhanced security controls
Making additional improvements to strengthen PupBox’s cybersecurity protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Massachusetts State AGOct 2 · first

Oregon State AGOct 2 · first

New Hampshire State AGOct 2 · first

Indiana State AGOct 2 · first

Montana State AGOct 2 · first

Maine State AGOct 2 · first

California State AGOct 2 · first

Washington State AGOct 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10682.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2020
Raw hash: 921b36150564c4328d9b7e8e0df5c4f5cbec9d64c7b716ba6c1bfbc563cb2052

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityPupBox

Victim entityPupBox

Incidentdiscovered Sep 2, 2020

Stated responseLaunched an investigation with the assistance of a leading cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com