MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Ballistic Products, Inc.

bd_cc0ec26377c09de6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2022

Filed

Sep 3, 2022

To disclose

22 weeks

Affected

1,242state residents only

Linked

8 filings

Confidence

69%

Full breach record for Ballistic Products, Inc. →

Ballistic Products, Inc. notified Washington AG of a third-party vendor malware incident affecting payment card data (names, card numbers, CVV, billing addresses) for transactions between Sept 2020 and Feb 2022. 1,242 WA residents notified in Sept 2022. Vendor removed malware and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d22 weeks discovery → filing

Incident timeline

undetected · 560 days

discovery → filing · 22 weeks / 155 days

Sep 18, 2020

Begins

Apr 1, 2022

Discovered

Sep 3, 2022

Filed

vs. sector median

+14 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_6af97512dc8d42cb2022-09-05 · +2dVerified
Indiana State AGbd_ee76c2033e23652f2022-09-01 · +2dVerified
California State AGbd_0a9e5025b2e7d8d82022-09-09 · +6dVerified
Maine State AGbd_aaecbad195251dcd2022-09-13 · +10dVerified

Show 3 more filings ↓up to 18d gap

Oregon State AGbd_c6b9c657e9d72d472022-09-13 · +10dVerified
New Hampshire State AGbd_4e5f71d683ca579d2022-09-21 · +18dVerified
Massachusetts State AGbd_ea262a4f9f55c5612022-09-21 · +18dVerified

Name: Spencer Fane
norm: spencer fane
Domain: spencerfane.com

Name: Ballistic Products, Inc.
norm: ballistic products
Industry: Retail & Consumerllm

Discovered: Apr 1, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 560 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2022
Affected individuals: 1,242state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: supply_chain

During the incident: Reported incident to law enforcement
Vendor identified and removed malware
Vendor blocked unauthorized activity
Engaged data security experts for investigation
Offered 12 months of credit and CyberScan monitoring
Offered $1,000,000 insurance reimbursement policy
Offered fully managed ID theft recovery services
Changes made: Vendor took additional steps to block unauthorized activity
Vendor launched extensive investigation with data security experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(155 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGSep 1 · first

Washington State AG+2d · this page

Montana State AG+4d

California State AG+8d

Maine State AG+12d

Oregon State AG+12d

New Hampshire State AG+20d

Massachusetts State AG+20d

Pattern: first filing Sep 1 (IN), last Sep 21 (MA) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM14550.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 3, 2022
Raw hash: 22ef4af68175c1a6b41b935dae5aa85176546d3fb85992f82ca85b0ceb6dde70

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySpencer Fane

Victim entityBallistic Products, Inc.

Incidentdiscovered Apr 1, 2022

Stated responseReported incident to law enforcement

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com