HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsMediumContained

TEMPUR-PEDIC MANAGEMENT, LLC

bd_b9421369e4f1231a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2016

Filed

Apr 11, 2017

To disclose

23 weeks

Affected

1,302state residents only

Linked

7 filings

Confidence

66%

Full breach record for TEMPUR-PEDIC MANAGEMENT, LLC →

Tempur-Pedic, via hosting vendor Aptos, Inc., notified Hawaii consumers of a security incident where unauthorized access to the Tempurpedic.com website resulted in the capture of payment card data. The intrusion occurred between Feb and Dec 2016. 1,302 Hawaii residents were notified.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due23 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 274 days

discovery → filing · 23 weeks / 161 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Apr 11, 2017

Filed

vs. sector median

+15 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_3b6e4ce3b3e36db22017-04-12 · +1dVerified by operator
South Carolina State AGbd_d441b936c45a4cf72017-04-10 · +1dVerified
Montana State AGbd_4cf6fd903fad9cbf2017-04-05 · +6dVerified
New Hampshire State AGbd_bfb66da280bec35f2017-04-04 · +7dVerified

Show 2 more filings ↓up to 7d gap

California State AGbd_d46247ee45324af52017-04-04 · +7dVerified
Washington State AGbd_d9ee40b43f54ddd22017-04-04 · +7dCandidate

Name: Aptos, Inc.
norm: aptos
Domain: aptos.com

Name: TEMPUR-PEDIC MANAGEMENT, LLC
norm: tempur pedic management
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 4, 2017
Affected individuals: 1,302state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported to federal law enforcement (FBI and U.S. Department of Justice)
Initial access: exploit_public_facing

During the incident: Initiating an internal investigation into the incident
Communicating with the vendor that hosted and operated the website
Removed the malware
Deploying file monitoring software and an endpoint security program
Reported to federal law enforcement
Offering one year of complimentary identity protection services
Changes made: Strengthening access controls
Making security updates to the systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGApr 4 · first

California State AGApr 4 · first

Washington State AGApr 4 · first

Montana State AG+1d

South Carolina State AG+6d

Hawaii State AG+7d · this page

Oregon State AG+8d

Pattern: first filing Apr 4 (NH), last Apr 12 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2016/05/Tempur-Pedic-OCP-2017-0180.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2017
Raw hash: 7005ecceb004764e981a546bb53c4b27b699f079fd1c7a97f49a0f3fdf3ccd35

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAptos, Inc.

Victim entityTEMPUR-PEDIC MANAGEMENT, LLC

Incidentdiscovered Nov 1, 2016

Stated responseInitiating an internal investigation into the incident

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org