HackingRetail & ConsumerRetailSkimmerVulnerability ExploitCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)LowContained

Aetrex Worldwide, Inc.

bd_a61c8c1f3ff36243 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 17, 2018

Filed

Jan 17, 2019

To disclose

4 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Aetrex Worldwide, Inc. →

Aetrex Worldwide, Inc. disclosed that an unauthorized third party inserted malicious code (a skimmer) into its website between June 22, 2018, and December 4, 2018, to harvest customer payment card information. The incident was discovered on December 17, 2018. Affected data includes cardholder names, addresses, credit card numbers, expiration dates, and CVVs. The company removed the malicious code, implemented additional security measures, and notified regulators and credit bureaus.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 178 days

discovery → filing · 4 weeks / 31 days

Jun 22, 2018

Begins

Dec 17, 2018

Discovered

Jan 17, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2b52a57158abd7642019-01-17Verified
Montana State AGbd_613ccc44cdf5d0382019-01-17Candidate
New Hampshire State AGbd_cba5a65ddb6bc7182019-01-22 · +5dVerified

Name: Aetrex Worldwide, Inc.
norm: aetrex worldwide

Name: Aetrex Worldwide, Inc.
norm: aetrex worldwide
Industry: Retail & Consumerllm

Discovered: Dec 17, 2018
Breach occurred: Jun 22, 2018 – Dec 4, 2018
Undetected for: 178 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notifying required state regulators and the credit reporting agencies about this incident
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Hired third-party forensic investigators
Removed the unauthorized code that led to the vulnerability
Implemented additional security measures to reduce the likelihood of a similar incident from happening in the future
Notifying required state regulators and the credit reporting agencies about this incident
Changes made: Implemented additional security measures to reduce the likelihood of a similar incident from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJan 17 · first

Montana State AGJan 17 · first

California State AGJan 17 · first · this page

New Hampshire State AG+5d

Pattern: first filing Jan 17 (MA), last Jan 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-143964
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2019
Raw hash: aa5f6fa5eccfda27fadfb1593c5f07a891d73db7ded5e57b84e64aff27033400

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAetrex Worldwide, Inc.

Victim entityAetrex Worldwide, Inc.

Incidentdiscovered Dec 17, 2018

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov