HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedTargetedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

Indigo Wild

bd_c1df3ed79fd2e5d3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 17, 2017

Filed

Jun 6, 2017

To disclose

7 weeks

Affected

134state residents only

Linked

6 filings

Confidence

65%

Full breach record for Indigo Wild →

Indigo Wild LLC notified customers of a data breach where malicious code on its website stole personal and payment information from purchases made between Nov 14, 2016 and Apr 17, 2017. Discovered April 17, 2017. Data included names, emails, addresses, and full payment card details. No specific count provided, though Rhode Island and Connecticut resident counts were noted in attached safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 154 days

discovery → filing · 7 weeks / 50 days

Nov 14, 2016

Begins

Apr 17, 2017

Discovered

Jun 6, 2017

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_7148803d17e9d0252017-05-15 · +22dVerified
California State AGbd_8c049d25fb0f53bc2017-05-15 · +22dVerified
Oregon State AGbd_17c8cdde05d621c92017-05-12 · +25dCandidate
Washington State AGbd_33162c0539929f6c2017-05-12 · +25dVerified

Show 1 more filing ↓up to 25d gap

New Hampshire State AGbd_b37750685fd2d4af2017-05-12 · +25dVerified

Name: Indigo Wild LLC
norm: indigo wild
Domain: indigo.ca

Name: Indigo Wild
norm: indigo wild
Domain: indigowild.com
Industry: Retail & Consumerllm

Discovered: Apr 17, 2017
Breach occurred: Nov 14, 2016 – Apr 17, 2017
Undetected for: 154 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2017
Affected individuals: 134state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: communicated with law enforcement agencies
Initial access: exploit_public_facing

During the incident: Remediated the issue to prevent further access
Notified the payment card networks
Communicated with law enforcement agencies regarding the incident
Made changes to our system and implemented additional safeguards to improve data security
Changes made: Implemented additional safeguards to improve data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGMay 12 · first

Washington State AGMay 12 · first

New Hampshire State AGMay 12 · first

Massachusetts State AG+3d

California State AG+3d

Montana State AG+25d · this page

Pattern: first filing May 12 (OR), last Jun 6 (MT) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Indigo-Wild.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 6, 2017
Raw hash: d1169b3a168280627b7a5ff9d9eef54833663ad96508ad40de598e7152adbbdb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityIndigo Wild LLC

Victim entityIndigo Wild

Incidentdiscovered Apr 17, 2017

Stated responseRemediated the issue to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov