HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

CertifiKID Holdings, LLC

bd_ba182c438b8bba0f · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 25, 2016

Filed

May 5, 2016

To disclose

6 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for CertifiKID Holdings, LLC →

CertifiKid LLC disclosed a data breach where malicious code was inserted into its e-commerce server between Jan 25 and Mar 19, 2016. Discovered Mar 25, 2016, the incident compromised customer names and credit card information (number, expiration, CVV). CertifiKid engaged Kroll for identity monitoring and notified card brands.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 60 days

discovery → filing · 6 weeks / 41 days

Jan 25, 2016

Begins

Mar 25, 2016

Discovered

May 5, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_21ce2914de949c4d2016-05-05Verified
California State AGbd_7c51879041e10b2d2016-05-05Verified
Washington State AGbd_c2daad87d2bea8f92016-05-05Verified
Oregon State AGbd_22dee931a80c352a2016-05-27 · +22dVerified

Name: CertifiKID Holdings, LLC
norm: certifikid holdings

Name: CertifiKID Holdings, LLC
norm: certifikid holdings
Industry: Retail & Consumerllm

Discovered: Mar 25, 2016
Breach occurred: Jan 25, 2016 – Mar 19, 2016
Undetected for: 60 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged third party experts to assist with this response
Consulting with legal, credit card processing, card brand, information technology and security experts
Notified the major card brands affected by this data breach
Provided affected card numbers to them to flag any unauthorized or fraudulent use
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Following recommendations from legal, credit card processing, card brand, information technology and security experts to protect affected persons
Ensuring that this type of disclosure will not again occur
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 5 · first

California State AGMay 5 · first

Washington State AGMay 5 · first

Montana State AGMay 5 · first · this page

Oregon State AG+22d

Pattern: first filing May 5 (MA), last May 27 (OR) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/CertifiKid-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2016
Raw hash: 6efbce535a9f50a8596688be8fd198ef275c16f76cee3ef56d2291564940bf99

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCertifiKID Holdings, LLC

Victim entityCertifiKID Holdings, LLC

Incidentdiscovered Mar 25, 2016

Stated responseEngaged third party experts to assist with this response

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov