HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationCredentialsFinancial accountIdentity (basic)MediumContained

A&A Global Imports, Inc

bd_cb2c205723fdf64b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 17, 2018

Filed

Jan 9, 2019

To disclose

21 weeks

Affected

2,783state residents only

Linked

5 filings

Confidence

70%

Full breach record for A&A Global Imports, Inc →

A&A Global Imports Inc. reported a cyberattack where unauthorized code on its website and potential database access compromised customer data from August 15, 2017, to January 4, 2019. Discovered August 17, 2018, the incident affected 2,783 Washington residents. Data included names, credentials, and credit card details. The company engaged forensic investigators, removed malicious code, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 367 days

discovery → filing · 21 weeks / 145 days

Aug 15, 2017

Begins

Aug 17, 2018

Discovered

Jan 9, 2019

Filed

vs. sector median

+13 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_5a69bf70ff12f32c2019-01-09Verified by operator
Massachusetts State AGbd_7eff5d1abe49ba3f2019-01-14 · +5dVerified
Oregon State AGbd_ca6d8911439ebdf02019-01-14 · +5dVerified
California State AGbd_e4bdcbdac5bda60e2019-01-14 · +5dVerified

Name: A&A Global Imports, Inc
norm: a a global imports

Name: A&A Global Imports, Inc
norm: a a global imports
Industry: Retail & Consumerllm

Discovered: Aug 17, 2018
Breach occurred: Aug 15, 2017 – Jan 4, 2019
Undetected for: 367 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2,783state-resident count only
Data types: Identity (basic)CredentialsFinancial account
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Coordinated with law enforcement
Worked with a leading computer security and forensic firm to investigate the incident
Removed the identified unauthorized code from the website
Worked to strengthen our website security
Migrated our website to an entirely new platform
Arranged for you to receive 12 months of free fraud detection and identity theft protection through Experian’s IdentityWorks program
Changes made: Removed the identified unauthorized code from the website
Worked to strengthen our website security to prevent this type of incident from happening in the future
Migrated our website to an entirely new platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(145 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJan 9 · first

Washington State AGJan 9 · first · this page

Massachusetts State AG+5d

Oregon State AG+5d

California State AG+5d

Pattern: first filing Jan 9 (MT), last Jan 14 (CA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10609.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 9, 2019
Raw hash: bcadcc9f6d301586473a6c7ece8aa48f6178359a6d3ff97775ab5e374b49f27a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityA&A Global Imports, Inc

Victim entityA&A Global Imports, Inc

Incidentdiscovered Aug 17, 2018

Stated responseCoordinated with law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com