HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Fred Usinger Inc

bd_be9cc8bc78f810e7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 7, 2018

Filed

Mar 28, 2018

To disclose

21 days

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Fred Usinger Inc →

Fred Usinger, Inc. notified customers of a data breach affecting its e-commerce website. The incident occurred between September 2017 and March 2018, discovered on March 7, 2018, when the hosting service provider reported unauthorized access. Personal information including names, addresses, emails, phone numbers, and payment card data (including security codes) was compromised. The company engaged ID Experts for identity theft recovery services and reviewed security protocols with its third-party vendor.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 7, 2018 → Notified Mar 29, 201822d ✓ CA 60-day OK21 days discovery → filing

Incident timeline

undetected · 187 days

discovery → filing · 21 days

Sep 1, 2017

Begins

Mar 7, 2018

Discovered

Mar 28, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_06092f4fb2b6e6d52018-03-29 · +1dVerified
Massachusetts State AGbd_043d88f3ef7cc9972018-04-02 · +5dVerified

Name: Fred Usinger Inc
norm: fred usinger

Name: Fred Usinger Inc
norm: fred usinger
Industry: Retail & Consumerllm

Discovered: Mar 7, 2018
Breach occurred: Sep 1, 2017 – Mar 31, 2018
Undetected for: 187 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 29, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Hosting service provider
Initial access: supply_chain

During the incident: Conducting a thorough review of the computer systems and protocols impacting its e-commerce website
Rigorously reviewing the information security processes and procedures implemented by its hosting service provider
Working with key third-party vendors to ensure that appropriate security measures are in place
Notified the major consumer reporting agencies about this incident
Offering to all our affected customers identity theft recovery services through ID Experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: CA 60-day OK · 22d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 7, 2018
→ Notified: Mar 29, 2018
22d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 7, 2018 → Notified: Mar 29, 2018	22d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGMar 28 · first · this page

Montana State AG+1d

Massachusetts State AG+5d

Pattern: first filing Mar 28 (CA), last Apr 2 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134869
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2018
Raw hash: ee7194e9b2f38b8f0a8123f17dd53ca5294accdf32d4596328adc0fe03a484d6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFred Usinger Inc

Victim entityFred Usinger Inc

Incidentdiscovered Mar 7, 2018

Stated responseConducting a thorough review of the computer systems and protocols impacting its e-commerce website

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov