HackingRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsCredentialsLowResolved

Matador Recordings, LLC

bd_de4adabce5cb7159 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 4, 2016

Filed

Jul 15, 2016

To disclose

10 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Matador Recordings, LLC →

Matador Recordings, LLC (d/b/a Matador Direct) notified customers of a data breach affecting its e-commerce websites. An unauthorized third party accessed customer information, including names, addresses, phone numbers, email addresses, payment card numbers, expiration dates, security codes (CVV), and account passwords. The incident occurred between April 28, 2015, and May 4, 2016, and was discovered on May 4, 2016, when the third-party website developer identified suspicious files. Matador engaged a cybersecurity firm and remediated the websites.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 4, 2016 → Notified Jul 13, 201670d ✗ CA 60-day late10 weeks discovery → filing

Incident timeline

undetected · 372 days

discovery → filing · 10 weeks / 72 days

Apr 28, 2015

Begins

May 4, 2016

Discovered

Jul 15, 2016

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_81db7ff6af04289e2016-07-15Verified
Massachusetts State AGbd_95cdb1d924386f132016-07-15Verified
Montana State AGbd_f566d97e10c037422016-07-15Candidate

Name: Matador Recordings, LLC
norm: matador recordings

Name: Matador Recordings, LLC
norm: matador recordings
Also named: Matador Recordings, LLCdba oflegal entity
“Matador Direct”dba oftrade name
Industry: Retail & Consumerllm

Discovered: May 4, 2016
Breach occurred: Apr 28, 2015 – May 4, 2016
Undetected for: 372 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Third-party website developer

During the incident: Hired a third-party cybersecurity firm to assist
Remediated the websites
Continued to work to strengthen the security of the websites
Changes made: Remediated the websites
Continued to work to strengthen the security of the websites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: CA 60-day late · 70d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 4, 2016
→ Notified: Jul 13, 2016
70d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 4, 2016 → Notified: Jul 13, 2016	70d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGJul 15 · first

Massachusetts State AGJul 15 · first

Montana State AGJul 15 · first

California State AGJul 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62853
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2016
Raw hash: 3620d20150853d7d1f4fc3cc116de2f47fb1534f4e18b2dec884bc7e560c2302

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMatador Recordings, LLC

Victim entityMatador Recordings, LLC

Incidentdiscovered May 4, 2016

Stated responseHired a third-party cybersecurity firm to assist

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov