MalwareRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowResolved

TEMPUR-PEDIC MANAGEMENT, LLC

bd_d46247ee45324af5 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 4, 2017

To disclose

—

Affected

Not disclosed

Linked

7 filings

Confidence

64%

Full breach record for TEMPUR-PEDIC MANAGEMENT, LLC →

Tempur-Pedic disclosed a data breach affecting customers who made payment card purchases on Tempurpedic.com between 2016 and September 30, 2016. An unauthorized individual accessed the website servers via a third-party hosting vendor and installed malicious software to capture payment card information. Affected data includes names, addresses, email addresses, phone numbers, payment card account numbers, and expiration dates. Social Security numbers were not involved. The incident was contained, malware removed, and the company transitioned to a new hosting vendor. One year of identity protection services was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2016

Begins

Apr 4, 2017

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_bfb66da280bec35f2017-04-04Verified
Washington State AGbd_d9ee40b43f54ddd22017-04-04Candidate
Montana State AGbd_4cf6fd903fad9cbf2017-04-05 · +1dVerified
South Carolina State AGbd_d441b936c45a4cf72017-04-10 · +6dVerified

Show 2 more filings ↓up to 8d gap

Hawaii State AGbd_b9421369e4f1231a2017-04-11 · +7dVerified
Oregon State AGbd_3b6e4ce3b3e36db22017-04-12 · +8dVerified by operator

Name: Aptos, Inc. on behalf of Retailers in Attached Addenda
norm: aptos inc on behalf of retailers in attached addenda

Name: TEMPUR-PEDIC MANAGEMENT, LLC
norm: tempur pedic management
Domain: tempurpedic.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 1, 2016 – Sep 30, 2016
Materiality determined: —
Notification sent: Mar 24, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported to federal law enforcement
Third party: via Previous website hosting vendor
Initial access: supply_chain

During the incident: Initiated an internal investigation into the incident
Communicated with the vendor that hosted and operated the website
Reported the incident to federal law enforcement
Offering one year of complimentary identity protection services
Changes made: Removed the malware
Deploying file monitoring software
Deploying an endpoint security program
Transitioned the Tempur-Pedic website to a new hosting vendor
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGApr 4 · first

Washington State AGApr 4 · first

California State AGApr 4 · first · this page

Montana State AG+1d

South Carolina State AG+6d

Hawaii State AG+7d

Oregon State AG+8d

Pattern: first filing Apr 4 (NH), last Apr 12 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-67320
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2017
Raw hash: b1f12cac1dfe2d1598cf2e807db57d0ac985f9e52407a15b2142df4844ccf6a3

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAptos, Inc. on behalf of Retailers in Attached Addenda

Victim entityTEMPUR-PEDIC MANAGEMENT, LLC

IncidentThird-Party / Supply Chain

Stated responseInitiated an internal investigation into the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov