HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Financial accountLowContained

San Diego Hardware

bd_dc54835f44a78c4d · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Dec 5, 2018

To disclose

—

Affected

80state residents only

Linked

4 filings

Confidence

66%

Full breach record for San Diego Hardware →

San Diego Hardware notified consumers of a data breach involving its website hardwaresource.com. A malicious script placed between Feb 5 and Aug 21, 2018, exfiltrated names, addresses, and credit card data. The incident was discovered after First Data reported fraudulent transactions. SD Hardware engaged forensic investigators, notified the FBI and state agencies, and is offering identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 5, 2018

Begins

Dec 5, 2018

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_78c4e765ddd3e67a2018-12-05Candidate
New Hampshire State AGbd_9e09372532c670612018-12-05Verified
Washington State AGbd_d9a6a6109905ae922018-12-05Verified

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Feb 5, 2018 – Aug 21, 2018
Materiality determined: —
Notification sent: Dec 6, 2018
Affected individuals: 80state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the applicable state agencies
Initial access: exploit_public_facing

During the incident: Placed the Website into 'maintenance mode'
Hired a specialized forensic IT firm to evaluate the potential data breach
Removed the malicious script
Notified the FBI
Notified the applicable state agencies
Offering a suite of fraud recovery services through MyIDCare
Changes made: Reviewing its online security policies to ensure all security measures are being taken to avoid such an incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGDec 5 · first

New Hampshire State AGDec 5 · first

Washington State AGDec 5 · first

Montana State AGDec 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/San-Diego-Hardware.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2018
Raw hash: 7fe173b2de616dc2836829fe265ea28b367543ef46936275280be45b6126ed8e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Diego Hardware

Victim entitySan Diego Hardware

IncidentUnauthorized Access

Stated responsePlaced the Website into 'maintenance mode'

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov