HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

San Diego Hardware

bd_d9a6a6109905ae92 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 10, 2018

Filed

Dec 5, 2018

To disclose

17 weeks

Affected

604state residents only

Linked

4 filings

Confidence

69%

Full breach record for San Diego Hardware →

San Diego Hardware notified Washington AG of a breach affecting 604 residents. Unauthorized access via malicious script on hardwaresource.com (Feb-Aug 2018) exposed credit card info and PII. Discovered Aug 10, 2018 after vendor notification. FBI and state agencies notified. Forensic firm engaged. Fraud recovery services offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 186 days

discovery → filing · 17 weeks / 117 days

Feb 5, 2018

Begins

Aug 10, 2018

Discovered

Dec 5, 2018

Filed

vs. sector median

+7 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_78c4e765ddd3e67a2018-12-05Candidate
New Hampshire State AGbd_9e09372532c670612018-12-05Verified
Montana State AGbd_dc54835f44a78c4d2018-12-05Verified by operator

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com
Industry: Retail & Consumerllm

Discovered: Aug 10, 2018
Breach occurred: Feb 5, 2018 – Aug 21, 2018
Undetected for: 186 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2018
Affected individuals: 604state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified applicable state agencies
Initial access: exploit_public_facing

During the incident: Placed the Website into 'maintenance mode'
Hired a specialized forensic IT firm to evaluate the potential data breach
Notified the FBI
Notified applicable state agencies
Removed the malicious script
Offered fraud recovery services
Changes made: Reviewing its online security policies to ensure all security measures are being taken to avoid such an incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGDec 5 · first

New Hampshire State AGDec 5 · first

Montana State AGDec 5 · first

Washington State AGDec 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10604.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2018
Raw hash: e107ee30ebf0d60a9358835e385f03b29fc3ddd183ba4307505e3dc99cf056fe

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Diego Hardware

Victim entitySan Diego Hardware

Incidentdiscovered Aug 10, 2018

Stated responsePlaced the Website into 'maintenance mode'

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com