HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)MediumContained

PAX Labs, Inc.

bd_ae35c365847dec6d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 15, 2016

Filed

Aug 12, 2016

To disclose

28 days

Affected

6,000

Linked

4 filings

Confidence

65%

Full breach record for PAX Labs, Inc. →

PAX Labs, Inc. disclosed a data breach affecting approximately 6,000 customers of its e-commerce sites PAXvapor.com and JUULvapor.com. Unauthorized parties accessed a cloud-based server between June 25 and July 22, 2016, installing malware to capture payment card data including cardholder names, addresses, card numbers, expiration dates, and CVV codes. The incident was discovered on July 15, 2016. PAX removed the malware, engaged forensic investigators, and implemented enhanced firewall rules and monitoring. Affected individuals were offered 12 months of identity protection.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 15, 2016 → Notified Aug 12, 201628d ✓ CA 60-day OK28 days discovery → filing

Incident timeline

undetected · 20 days

discovery → filing · 28 days

Jun 25, 2016

Begins

Jul 15, 2016

Discovered

Aug 12, 2016

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_cdfab40ab9f0cea12016-08-12Candidate
New Hampshire State AGbd_8bd1ff1a24c029ad2016-08-11 · +1dVerified
Massachusetts State AGbd_a1430bc57e4c62122016-08-11 · +1dVerified

Name: PAX Labs, Inc.
norm: pax labs

Name: PAX Labs, Inc.
norm: pax labs
Industry: Retail & Consumerllm

Discovered: Jul 15, 2016
Breach occurred: Jun 25, 2016 – Jul 22, 2016
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2016
Affected individuals: 6,000nationwide
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: exploit_public_facing

During the incident: Removed unauthorized software on July 15, 2016
Removed similar software added on July 22, 2016
Working with a forensics team on this investigation
Put in place additional security measures, including more aggressive firewall rules and detailed system monitoring tools
Retained the services of a well-respected cybersecurity firm
Changes made: Put in place additional security measures around our online stores
Implemented more aggressive firewall rules
Implemented detailed system monitoring tools
Offered 12 months of complimentary identity protection through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: CA 60-day OK · 28d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 15, 2016
→ Notified: Aug 12, 2016
28d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 15, 2016 → Notified: Aug 12, 2016	28d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGAug 11 · first

Massachusetts State AGAug 11 · first

Montana State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-63327
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2016
Raw hash: 62ba5c27cd8d26139e445d509da68eb5279c2123d6db851688375b48124bcf3a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPAX Labs, Inc.

Victim entityPAX Labs, Inc.

Incidentdiscovered Jul 15, 2016

Stated responseRemoved unauthorized software on July 15, 2016

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov