HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

OXO International Ltd.

bd_b5855d52ca392d1e · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 17, 2018

Filed

Jan 3, 2019

To disclose

17 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for OXO International Ltd. →

OXO International, Ltd. disclosed that unauthorized code on its e-commerce website may have compromised customer personal information, including names, addresses, and credit card details. The incident affected orders placed between June 2017 and October 2018. OXO confirmed the breach on December 17, 2018, after forensic investigation. The company removed the malicious code, conducted penetration testing, and offered one year of identity monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 556 days

discovery → filing · 17 days

Jun 9, 2017

Begins

Dec 17, 2018

Discovered

Jan 3, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_4c6fa60d8da1d1e72018-12-28 · +6dCandidate
New Hampshire State AGMagecartbd_4ffe12b67cda62a82018-12-28 · +6dVerified

Name: OXO International Ltd.
norm: oxo international
Domain: oxo.com

Name: OXO International Ltd.
norm: oxo international
Domain: oxo.com
Industry: Retail & Consumerllm

Discovered: Dec 17, 2018
Breach occurred: Jun 9, 2017 – Oct 16, 2018
Undetected for: 556 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Working with recognized security consultants to conduct a thorough investigation of the incident
Retained forensic investigators to identify past website vulnerabilities
Investigated the nature of the malicious code
Removed the unauthorized code
Conducted systems scans
Reissued access credentials
Retained outside consultants to conduct penetration testing on its website
Secured the services of Kroll to provide identity monitoring at no cost for one year
Changes made: Conducted penetration testing on its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGDec 28 · first

New Hampshire State AGDec 28 · first

California State AG+6d · this page

Pattern: first filing Dec 28 (MT), last Jan 3 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-143479
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2019
Raw hash: ff0766bf994d918594fc6e948dc7a30cf8babdd567574015a995bf6c242712a7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOXO International Ltd.

Victim entityOXO International Ltd.

Incidentdiscovered Dec 17, 2018

Stated responseWorking with recognized security consultants to conduct a thorough investigation of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov