HackingRetail & ConsumerRetailCapture App DataBackdoor / C2Supply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainPCILowContained
Scales Plus LLC
bd_cce15d6d1a03673b · schema v1 · pii pii-v1
Full breach record for Scales Plus LLC →Scales Plus LLC, an online retailer at scalesplus.com, discovered on December 11, 2024 that a bad actor had injected malicious code into their online store via a compromised third-party application. The code may have captured payment card data entered by customers during purchases. The breach occurred on October 15, 2024. Seven Maine residents were affected. The third-party application was subsequently remediated. No identity theft protection services were offered.
Maine clockDiscovered Dec 11, 2024 → Filed with AG Jan 10, 202530d ✓ ME AG ≤30d4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_1896b88a0da80a8dMontana State AGfiled 2025-01-10Candidate
- bd_2afea3bf15d7ef7aIndiana State AGfiled 2025-01-10Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1b943b7b-d215-4325-ad6a-94c89296c4d3.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 10, 2025
- Raw hash
- 9c09087b1ec86b7d7dde3ce34e8663754d63c0125012f4ec3a0ba3f53b558ecf
Reporting entity
- Name
- Scales Plus LLCnorm: scales plus
- Domain
- scalesplus.com
Victim entity
- Name
- Scales Plus LLCnorm: scales plus
- Domain
- scalesplus.com
- Industry
- Retail & Consumerllm
Incident
- Discovered
- Dec 11, 2024
- Materiality determined
- —
- Notification sent
- Jan 10, 2025
- Affected individuals
- 7
- Data types
- PCI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1056 Input Capture
- Threat actor
- ExternalFinancial
- Regulator citations
- Notification filed with Maine Attorney General
- Initial access
- supply_chain
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 11, 2024→ Filed with AG: Jan 10, 202530d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.