MalwareRetail & ConsumerManufacturingRetailRansomwareCapture Stored DataData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PIIIdentity (basic)Financial accountMediumContained

TEMPUR-PEDIC MANAGEMENT, LLC

bd_d9ee40b43f54ddd2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2017

Filed

Apr 4, 2017

To disclose

8 weeks

Affected

7,366state residents only

Linked

7 filings

Confidence

70%

Full breach record for TEMPUR-PEDIC MANAGEMENT, LLC →

Tempur-Pedic notified Washington AG of a cyberattack involving malware installed on its website servers by an unauthorized party via its hosting vendor. The incident, discovered in Feb 2017, affected payment card data and PII of 7,366 Washington residents. Remediation included malware removal and enhanced security monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 346 days

discovery → filing · 8 weeks / 57 days

Feb 26, 2016

Begins

Feb 6, 2017

Discovered

Apr 4, 2017

Filed

vs. sector median

+1 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_bfb66da280bec35f2017-04-04Verified
California State AGbd_d46247ee45324af52017-04-04Verified
Montana State AGbd_4cf6fd903fad9cbf2017-04-05 · +1dVerified
South Carolina State AGbd_d441b936c45a4cf72017-04-10 · +6dVerified

Show 2 more filings ↓up to 8d gap

Hawaii State AGbd_b9421369e4f1231a2017-04-11 · +7dVerified
Oregon State AGbd_3b6e4ce3b3e36db22017-04-12 · +8dVerified by operator

Name: Aptos
norm: aptos

Name: TEMPUR-PEDIC MANAGEMENT, LLC
norm: tempur pedic management
Industry: Retail & ConsumerllmManufacturingllm

Discovered: Feb 6, 2017
Breach occurred: Feb 26, 2016 – Dec 5, 2016
Undetected for: 346 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 4, 2017
Affected individuals: 7,366state-resident count only
Data types: PIIIdentity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: reported to federal law enforcement
Initial access: exploit_public_facing

During the incident: Initiating an internal investigation into the incident
Communicating with the vendor that hosted and operated the website
Reported to federal law enforcement
Offering one year of complimentary identity protection services
Changes made: Removed the malware
Deploying file monitoring software
Deploying an endpoint security program
Transitioned to a new hosting vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGApr 4 · first

California State AGApr 4 · first

Washington State AGApr 4 · first · this page

Montana State AG+1d

South Carolina State AG+6d

Hawaii State AG+7d

Oregon State AG+8d

Pattern: first filing Apr 4 (NH), last Apr 12 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9690.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2017
Raw hash: a6b5dfc36a2b9b39e227015421bc1bbbb5a174a5f05b674c6ac72f39e0ae027f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAptos

Victim entityTEMPUR-PEDIC MANAGEMENT, LLC

Incidentdiscovered Feb 6, 2017

Stated responseInitiating an internal investigation into the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com