HackingVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowResolved
OXO International Ltd.
bd_b5855d52ca392d1e · schema v1 · pii pii-v1
Full breach record for OXO International Ltd. →OXO International, Ltd. notified California AG of a data breach involving unauthorized code on its e-commerce site. The incident, discovered Dec 17, 2018, affected customer data (names, addresses, credit card info) entered between June 2017 and Oct 2018. OXO engaged forensic investigators, removed the code, and provided one year of Kroll identity monitoring.
California clockDiscovered Dec 17, 2018 → Notified Dec 17, 20180d ✓ CA 60-day OK17 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-143479
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 3, 2019
- Raw hash
- ff0766bf994d918594fc6e948dc7a30cf8babdd567574015a995bf6c242712a7
Reporting entity
- Name
- OXO International Ltd.norm: oxo international
Victim entity
- Name
- OXO International Ltd.norm: oxo international
Incident
- Discovered
- Dec 17, 2018
- Materiality determined
- Dec 17, 2018
- Notification sent
- Dec 17, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed breach notification with California Office of the Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 days(17 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 17, 2018→ Notified: Dec 17, 20180d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.