HackingRetail & ConsumerRetailStolen CredentialsData MishandlingSupply Chain (3P Vendor)Data ExfiltratedPIIPCIIdentity (basic)Financial accountLowContained

Atlantic Cigar Co.

bd_b5772fa0842b7d7b · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2017

Filed

Feb 27, 2017

To disclose

17 days

Affected

93state residents only

Linked

5 filings

Confidence

66%

Full breach record for Atlantic Cigar Co. →3 incidents on file

Atlantic Cigar Co. notified customers of a data breach involving third-party provider Aptos. In November 2016, Aptos systems were compromised, leading to unauthorized access to customer payment card information, names, and addresses. Atlantic Cigar Co. notified customers on February 10, 2017, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 101 days

discovery → filing · 17 days

Nov 1, 2016

Begins

Feb 10, 2017

Discovered

Feb 27, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

South Carolina State AGbd_458ad445b06a55e72017-02-28 · +1dVerified
Washington State AGbd_5e4ce0ba9672f6992017-03-08 · +9dVerified
New Hampshire State AGbd_90a3f7720b4cfc2e2017-03-08 · +9dVerified
Oregon State AGbd_7fae23b7ae3326182017-03-09 · +10dVerified

Name: Atlantic Cigar Co.
norm: atlantic cigar

Name: Atlantic Cigar Co.
norm: atlantic cigar
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Breach occurred: Nov 1, 2016
Undetected for: 101 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 10, 2017
Affected individuals: 93state-resident count only
Data types: PIIPCIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Aptos reported suspicions to U.S. law enforcement agencies
Third party: via Aptos
Initial access: supply_chain

During the incident: Aptos worked with a leading cybersecurity firm to remove the malware from and update the security of its systems
Atlantic Cigar Co. has arranged to have AllClear ID protect your identity for 12 months at no cost to you
Changes made: Strengthening access controls
Updating security of systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGFeb 27 · first · this page

South Carolina State AG+1d

Washington State AG+9d

New Hampshire State AG+9d

Oregon State AG+10d

Pattern: first filing Feb 27 (MT), last Mar 9 (OR) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Atlantic-Cigar-Co.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2017
Raw hash: 47b530ca69727b75ee7234d2d7eba1e00d6f5fec444abcc4f5a05ef58f47858a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAtlantic Cigar Co.

Victim entityAtlantic Cigar Co.

Incidentdiscovered Feb 10, 2017

Stated responseAptos worked with a leading cybersecurity firm to remove the malware from and update the security of its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov