HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsFinancial accountFinancial credentialsLowContained

A&A Global Imports, Inc

bd_e4bdcbdac5bda60e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 17, 2018

Filed

Jan 14, 2019

To disclose

21 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

63%

Full breach record for A&A Global Imports, Inc →

A&A Global Imports, Inc. disclosed that unauthorized code was placed on its website, potentially capturing customer information during checkout and accessing the customer database. The incident occurred between August 15, 2017, and January 4, 2019, and was discovered on August 17, 2018, after law enforcement notification. Affected data included names, phone numbers, usernames, passwords, addresses, and in some cases, credit card numbers, expiration dates, and CVV codes. The company removed the code, migrated its website, and offered 12 months of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 367 days

discovery → filing · 21 weeks / 150 days

Aug 15, 2017

Begins

Aug 17, 2018

Discovered

Jan 14, 2019

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_7eff5d1abe49ba3f2019-01-14Verified
Oregon State AGbd_ca6d8911439ebdf02019-01-14Verified
Montana State AGbd_5a69bf70ff12f32c2019-01-09 · +5dVerified by operator
Washington State AGbd_cb2c205723fdf64b2019-01-09 · +5dVerified

Name: A&A Global Imports, Inc
norm: a a global imports

Name: A&A Global Imports, Inc
norm: a a global imports
Industry: Retail & Consumerllm

Discovered: Aug 17, 2018
Breach occurred: Aug 15, 2017 – Jan 4, 2019
Undetected for: 367 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified by law enforcement on August 17, 2018Coordinated with law enforcement
Initial access: exploit_public_facing

During the incident: Coordinated with law enforcement
Engaged a leading computer forensic firm to conduct a forensic investigation
Removed the identified unauthorized code from the website
Worked to strengthen website security
Migrated website to an entirely new platform
Offered 12 months of free fraud detection and identity theft protection through Experian’s IdentityWorks program
Changes made: Removed the identified unauthorized code from the website
Worked to strengthen website security to prevent this type of incident from happening in the future
Migrated website to an entirely new platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(150 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJan 9 · first

Washington State AGJan 9 · first

Massachusetts State AG+5d

Oregon State AG+5d

California State AG+5d · this page

Pattern: first filing Jan 9 (MT), last Jan 14 (CA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-143824
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2019
Raw hash: 7242961624d27d586c8102ec90efb4f35e4886f28ada02cab2f7051f72271b05

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityA&A Global Imports, Inc

Victim entityA&A Global Imports, Inc

Incidentdiscovered Aug 17, 2018

Stated responseCoordinated with law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov