HackingRetail & ConsumerTechnologyRetailAbuse Of FunctionalityCapture Stored DataTargetedData ExfiltratedPIIIdentity (basic)Financial accountFinancial credentialsMediumContained

BEL USA LLC

bd_ccae1af0c49f26e9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2018

Filed

Dec 26, 2018

To disclose

6 weeks

Affected

1,553state residents only

Linked

6 filings

Confidence

70%

Full breach record for BEL USA LLC →2 incidents on file

Bel USA LLC, operator of DiscountMugs.com, disclosed a cybersecurity incident where unauthorized code was inserted into its shopping cart page between August 5 and November 16, 2018. The code collected customer PII and payment card details (including CVV2). Approximately 1,553 Washington residents were affected. Bel USA removed the code, engaged forensic counsel, notified law enforcement and card companies, and provided 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 103 days

discovery → filing · 6 weeks / 40 days

Aug 5, 2018

Begins

Nov 16, 2018

Discovered

Dec 26, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_1b22d8ec0a32e0f42018-12-26Verified
Massachusetts State AGbd_2afd0bbcfb7e9d6d2018-12-26Verified
New Hampshire State AGbd_421570bfefefba372018-12-26Verified
Montana State AGbd_2fe11865ef1e51412018-12-31 · +5dVerified by operator

Show 1 more filing ↓up to 9d gap

South Carolina State AGbd_8a9e81f6ae071ab92019-01-04 · +9dVerified

Name: Vorys, Sater, Seymour and Pease LLP
norm: vorys sater seymour and pease

Name: BEL USA LLC
norm: bel usa
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Nov 16, 2018
Breach occurred: Aug 5, 2018 – Nov 16, 2018
Undetected for: 103 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,553state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Reported the matter to law enforcement
Initial access: exploit_public_facing

During the incident: Immediately initiated an investigation
Immediately removed the unauthorized code
Reported the matter to law enforcement and to the payment card companies
Taken steps to strengthen its website’s security
Retained a leading computer security firm
Working with law enforcement and the payment card companies in their investigations
Changes made: Strengthened website’s security
Arranged to have AllClear ID protect potentially affected residents’ identities for 12 months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGDec 26 · first

Massachusetts State AGDec 26 · first

New Hampshire State AGDec 26 · first

Washington State AGDec 26 · first · this page

Montana State AG+5d

South Carolina State AG+9d

Pattern: first filing Dec 26 (CA), last Jan 4 (SC) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10606.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 26, 2018
Raw hash: 41e843d61121ee989983bc4b5a043b96bcda91746334eb8904c3c46e0261a13b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityVorys, Sater, Seymour and Pease LLP

Victim entityBEL USA LLC

Incidentdiscovered Nov 16, 2018

Stated responseImmediately initiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com