MalwareTechnologyRetail & ConsumerInformationRansomwareData EncryptedTargetedIdentity (basic)Financial accountFinancial credentialsMediumContained

Volusion

bd_daa1bef32d1f2d23 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 8, 2019

Filed

Apr 21, 2020

To disclose

28 weeks

Affected

12,358state residents only

Linked

11 filings

Confidence

65%

Full breach record for Volusion →

Volusion, LLC reported a data incident where malware on its e-commerce platform exposed customer personal information (names, addresses, credit card numbers, CVVs) between Sept 7 and Oct 8, 2019. Volusion detected the incident on Oct 8, 2019, removed the malware, notified the FBI, and engaged forensic experts. The incident was contained and internal procedures were updated.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 31 days

discovery → filing · 28 weeks / 196 days

Sep 7, 2019

Begins

Oct 8, 2019

Discovered

Apr 21, 2020

Filed

vs. sector median

+17 wks slower

This filing is one of 11 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_63436097b06950992020-04-21Verified
New Hampshire State AGbd_b433e999445bbb792020-04-22 · +1dVerified
Montana State AGbd_28a4ba033c090f472020-04-20 · +1dVerified
Massachusetts State AGbd_4d5326538bcdcff12020-04-20 · +1dVerified

Show 6 more filings ↓up to 111d gap

Hawaii State AGbd_67a3dd2f7493b68a2020-04-20 · +1dVerified
Delaware State AGbd_6ac6f52a70d9c8c92020-04-20 · +1dVerified
Indiana State AGbd_8b37e8965834db742020-04-20 · +1dVerified
California State AGbd_bb688789eb5f4fec2020-04-20 · +1dVerified
Washington State AGbd_f7b3cba80f6e60b92020-04-20 · +1dVerified
Illinois State AGbd_8249301beb911ed82020-01-01 · +111dCandidate

Name: Volusion
norm: volusion

Name: Volusion
norm: volusion
Industry: TechnologyllmRetail & Consumerllm

Discovered: Oct 8, 2019
Breach occurred: Sep 7, 2019 – Oct 8, 2019
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 12,358state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Took steps to secure the platform
Removed the malware
Notified the FBI
Began an investigation
Hired independent cybersecurity experts to assist with that investigation
Changes made: Updated its internal procedures based on the findings of the investigation
Added additional safeguards to minimize the chance that an incident like this could occur in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(196 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+110d

Massachusetts State AG+110d

Hawaii State AG+110d

Delaware State AG+110d

Indiana State AG+110d

California State AG+110d

Washington State AG+110d

Oregon State AG+111d

South Carolina State AG+111d · this page

New Hampshire State AG+112d

Pattern: first filing Jan 1 (IL), last Apr 22 (NH) — a 112-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/Volusion.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2020
Raw hash: 1a37f512b2fb00b0f3197c56274eb83d39600c908609961130a399259e38b7a2

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityVolusion

Victim entityVolusion

Incidentdiscovered Oct 8, 2019

Stated responseTook steps to secure the platform

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov