HackingRetail & ConsumerRetailSkimmerCapture App DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsPIIPCILowResolved

First Aid Beauty

bd_da211918bbf1b9ac · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 8, 2019

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

78%

Full breach record for First Aid Beauty →

First Aid Beauty Limited notified California of a web skimming attack on firstaidbeauty.com between April 15 and October 25, 2019. An unauthorized third party placed malicious code on the website that captured customer payment card data (card number, CVV, expiration date) as well as names, addresses, phone numbers, and email addresses. The company took the site offline, removed the code, engaged a data security expert, and offered one year of Experian credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 15, 2019

Begins

Nov 8, 2019

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_615fc4de84c079222019-11-08Candidate
Massachusetts State AGbd_97292813f8a3c8f82019-11-08Verified
Montana State AGbd_db3165362653ad5b2019-11-08Verified by operator
Washington State AGbd_f8a5c17831a5c8b32019-11-08Verified

Name: First Aid Beauty
norm: first aid beauty
Domain: firstaidbeauty.com

Name: First Aid Beauty
norm: first aid beauty
Domain: firstaidbeauty.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Apr 15, 2019 – Oct 25, 2019
Materiality determined: —
Notification sent: Nov 8, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsPIIPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1059 Command and Scripting InterpreterT1056 Input CaptureT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took steps to block the malicious code and took firstaidbeauty.com offline after we learned of the issue
Engaged a leading data security expert to investigate the matter and understand the scope of the issue
Changes made: The malicious code has been removed and no longer poses a risk to firstaidbeauty.com users
Arranged to offer identity protection and credit monitoring services through Experian to affected individuals for one year at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGNov 8 · first

Massachusetts State AGNov 8 · first

Montana State AGNov 8 · first

Washington State AGNov 8 · first

California State AGNov 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-184197
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2019
Raw hash: 2de8ede18b09fbe2e24e02ab5dceff639c52cff6ff7fd55900565adac239c4e3

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFirst Aid Beauty

Victim entityFirst Aid Beauty

IncidentUnauthorized Access

Stated responseTook steps to block the malicious code and took firstaidbeauty.com offline after we learned of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov