HackingRetail & ConsumerRetailStolen CredentialsTargetedData ExfiltratedPIIFinancial accountFinancial credentialsLowContained

DC International, Inc.

bd_a684ad8a1fa18736 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 9, 2018

Filed

Nov 5, 2018

To disclose

8 weeks

Affected

6state residents only

Linked

4 filings

Confidence

64%

Full breach record for DC International, Inc. →

DC International notified customers of a data security incident affecting Leatherology.com transactions between July 20 and September 9, 2018. Malicious code captured personal and credit card data (name, billing address, email, card number, expiration, CVV). The company removed the code, engaged law enforcement and credit agencies, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 8 weeks / 57 days

Jul 20, 2018

Begins

Sep 9, 2018

Discovered

Nov 5, 2018

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_5ae5f761acfa3dd52018-11-07 · +2dVerified
Massachusetts State AGbd_1727e4ee2a6d52bf2018-11-08 · +3dVerified
New Hampshire State AGbd_7cb51b59f4a1e88c2018-11-08 · +3dVerified

Name: DC International, Inc.
norm: dc international
Domain: dcint.net

Name: DC International, Inc.
norm: dc international
Domain: dcint.net
Industry: Retail & Consumerllm

Discovered: Sep 9, 2018
Breach occurred: Jul 20, 2018 – Sep 9, 2018
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2018
Affected individuals: 6state-resident count only
Data types: PIIFinancial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: working closely with law enforcement
Initial access: exploit_public_facing

During the incident: Removed the malicious code
Continuing to probe our system for vulnerabilities
Notified our e-commerce platform security team
Working closely with the three major credit agencies, law enforcement, and IT security experts to investigate
Offering one year of free credit monitoring
Changes made: Fully remove the malicious code
Prevent further unauthorized access
Probe our system for vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 5 · first · this page

California State AG+2d

Massachusetts State AG+3d

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-84.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 5, 2018
Raw hash: ebbbfb0205052d0c2179fa0a375467292723374accc5b52db666310487792b37

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDC International, Inc.

Victim entityDC International, Inc.

Incidentdiscovered Sep 9, 2018

Stated responseRemoved the malicious code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov