HackingTechnologyInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)LowContained

Net32, Inc.

bd_a4e264a527ee3846 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 22, 2018

Filed

Oct 25, 2018

To disclose

5 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Net32, Inc. →

Net32, Inc. disclosed that a third-party vendor misused its log-in credentials to improperly access Net32's order management system between September 22 and September 25, 2018. The vendor used these credentials to generate anomalous order activity, revealing credit card information. Net32 suspended the vendor's credentials on September 25 and required all vendors to reset passwords. Personal information, potentially including credit card numbers, may have been exposed. Net32 offered free credit monitoring via Experian to affected customers.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 22, 2018 → Notified Sep 27, 20185d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 33 days

Sep 22, 2018

Begins

Sep 22, 2018

Discovered

Oct 25, 2018

Filed

vs. sector median

14 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_d3fc12c6eb803f0f2018-10-25Verified
Montana State AGbd_ec5d21b48b1c67862018-10-25Candidate
New Hampshire State AGbd_fe453f2b802293fb2018-10-25Verified

Name: Net32, Inc.
norm: net32

Name: Net32, Inc.
norm: net32
Industry: Technologyllm

Discovered: Sep 22, 2018
Breach occurred: Sep 22, 2018 – Sep 25, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 27, 2018
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via Third-party vendor
Initial access: supply_chain

During the incident: Required all vendors to change their credentials
Implemented new requirements for how vendors must treat their credentials
Partnered with Experian to provide free credit monitoring service to all customers who have found potentially fraudulent charges on their accounts
Changes made: Implemented new requirements for how vendors must treat their credentials
Changing how customer orders are stored and processed so that even if a vendor's credentials are compromised, this type of improper access to customer personal information should not occur
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: CA 60-day OK · 5d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 22, 2018
→ Notified: Sep 27, 2018
5d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 22, 2018 → Notified: Sep 27, 2018	5d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 25 · first

Montana State AGOct 25 · first

New Hampshire State AGOct 25 · first

California State AGOct 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141126
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 25, 2018
Raw hash: e1bcc2818105e6c9baabef106988a85b933d000a314b7cf9717d4ed656883a53

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNet32, Inc.

Victim entityNet32, Inc.

Incidentdiscovered Sep 22, 2018

Stated responseRequired all vendors to change their credentials

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov