MalwareRetail & ConsumerRetailRansomwareData ExfiltratedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Expresso Parts

bd_df4661e5be99705d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 21, 2019

Filed

Aug 20, 2019

To disclose

9 weeks

Affected

7state residents only

Confidence

66%

Full breach record for Expresso Parts →

Espresso Parts LLC notified Montana residents of a data breach occurring June 4-21, 2019. A hacker injected skimming malware into the ecommerce platform theme, accessing customer names, addresses, and full credit card details (including CVVs). The company engaged forensic remediation and provided one year of Kroll identity monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 9 weeks / 60 days

Jun 4, 2019

Begins

Jun 21, 2019

Discovered

Aug 20, 2019

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident

Name: Expresso Parts
norm: expresso parts

Name: Expresso Parts
norm: expresso parts
Industry: Retail & Consumerllm

Discovered: Jun 21, 2019
Breach occurred: Jun 4, 2019 – Jun 21, 2019
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 7state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took steps to remediate the vulnerability and remove the malicious malware
Audited our systems to validate that there was no other unauthorized access
Working with the security partner of our third party software provider to ensure the vulnerability does not recur
Notified our credit card payment processor of the incident
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Remediate the vulnerability
Remove the malicious malware
Audited our systems to validate that there was no other unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-70.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2019
Raw hash: 0ee2db5a76a1c28d1137af77b236b9e308683df22287e95def1c43b9db87f46a

Reporting entityExpresso Parts

Victim entityExpresso Parts

Incidentdiscovered Jun 21, 2019

Stated responseTook steps to remediate the vulnerability and remove the malicious malware

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov