HackingFinancial ServicesTechnologyFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

YAPSTONE, INC.

bd_dde5d8858204c461 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2015

Filed

Sep 25, 2015

To disclose

7 weeks

Affected

3,486state residents only

Linked

3 filings

Confidence

66%

Full breach record for YAPSTONE, INC. →2 incidents on file

YapStone, Inc. notified Hawaii OCP of a data breach affecting 3,486 residents. Unauthorized access occurred via a URL vulnerability between July 15, 2014, and August 5, 2015. Exposed data included names, SSNs, driver's licenses, and bank account numbers. YapStone blocked access on August 4, 2015, engaged forensic experts, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 385 days

discovery → filing · 7 weeks / 52 days

Jul 15, 2014

Begins

Aug 4, 2015

Discovered

Sep 25, 2015

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_c1f357b380f215f82015-09-11 · +14dCandidate
Massachusetts State AGbd_cd7c226a6be0eb622015-09-11 · +14dVerified

Name: YAPSTONE, INC.
norm: yapstone
Domain: yapstone.com

Name: YAPSTONE, INC.
norm: yapstone
Domain: yapstone.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Aug 4, 2015
Breach occurred: Jul 15, 2014 – Aug 5, 2015
Undetected for: 385 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2015
Affected individuals: 3,486state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Hawaii Office of Consumer Protection
Initial access: exploit_public_facing

During the incident: Blocked unauthorized access to the URL
Retained outside experts to investigate the incident
Offering 24 months of credit monitoring services to affected individuals
Changes made: Increasing the security protections of the YapStone site
Enhancing and strengthening YapStone's internal password rules, and storage mechanisms
Increased active monitoring of the affected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGSep 11 · first

Massachusetts State AGSep 11 · first

Hawaii State AG+14d · this page

Pattern: first filing Sep 11 (CA), last Sep 25 (HI) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2015/12/OCP-2015-0602.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2015
Raw hash: 9ebcfe50f351ac74096a8d6c795ae9e05d335ad1789832f4be71525ff7b9bf09

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityYAPSTONE, INC.

Victim entityYAPSTONE, INC.

Incidentdiscovered Aug 4, 2015

Stated responseBlocked unauthorized access to the URL

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org