HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Kayser-Roth, Inc.

bd_cff9302ab13ddd09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2017

Filed

Jul 5, 2017

To disclose

21 weeks

Affected · nationwide

90,548492 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Kayser-Roth, Inc. →3 incidents on file

Kayser-Roth, Inc. notified New Hampshire AG of a third-party data breach involving its e-commerce vendor, Aptos Inc. Unauthorized users accessed customer names, addresses, phone numbers, emails, and payment card data for orders placed between Feb 2016 and Dec 2016. 90,548 individuals affected (492 in NH). Discovered Feb 6, 2017. Notices mailed June 26, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 371 days

discovery → filing · 21 weeks / 149 days

Feb 1, 2016

Begins

Feb 6, 2017

Discovered

Jul 5, 2017

Filed

vs. sector median

+14 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

South Carolina State AGbd_08f13f5794e8a6ea2017-07-05Verified
California State AGbd_a84a721cdf83e5642017-07-05Verified
Montana State AGbd_b53bf980330e0a422017-07-03 · +2dVerified
Oregon State AGbd_c8f623bb36a6f0112017-06-20 · +15dCandidate

Show 2 more filings ↓up to 35d gap

Washington State AGbd_656a73d558860e4e2017-06-19 · +16dVerified
Montana State AGbd_07a3d2a27cc5b7c62017-08-09 · +35dVerified by operator

Name: Kayser-Roth, Inc.
norm: kayser roth

Name: Kayser-Roth, Inc.
norm: kayser roth
Industry: Retail & Consumerllm

Discovered: Feb 6, 2017
Breach occurred: Feb 1, 2016 – Dec 6, 2016
Undetected for: 371 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2017
Affected individuals: 90,548state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Aptos worked with the FBI Cyber division and the U.S. Department of Justice to investigateAptos received an official request from the FBI to delay disclosure for a minimum of 60 days
Third party: via Aptos Inc.
Initial access: supply_chain

During the incident: Engaged Mandiant, a forensic cybersecurity firm, to assist with stopping and remedying the data security breach
Notified FBI Cyber division and U.S. Department of Justice
Notified all three major credit reporting agencies, Equifax, TransUnion, and Experian
Mailed copies of enclosed notices to potentially affected New Hampshire residents
Changes made: Malicious software used to access the system has been completely removed
Deploying additional integrity monitoring software to alert to any similar attack
Implemented changes to its systems for best-in-class security with the assistance of external security consultants
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Washington State AGJun 19 · first

Oregon State AG+1d

Montana State AG+14d

South Carolina State AG+16d

California State AG+16d

New Hampshire State AG+16d · this page

Montana State AG+51d

Pattern: first filing Jun 19 (WA), last Aug 9 (MT) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kayser-roth-20170705.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2017
Raw hash: a2b46fe133da015184aac3c50076b8c6c1eee6e415a6cb2d2604c797fd2d8080

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityKayser-Roth, Inc.

Victim entityKayser-Roth, Inc.

Incidentdiscovered Feb 6, 2017

Stated responseEngaged Mandiant, a forensic cybersecurity firm, to assist with stopping and remedying the data security breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov