HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedPIIFinancial accountIdentity (basic)LowContained

Outdoor Smart! Inc

bd_e9416fffa56fe7eb · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 3, 2025

Filed

Dec 19, 2025

To disclose

7 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

66%

Full breach record for Outdoor Smart! Inc →

OutdoorSmart! Inc. notified consumers of a data breach affecting its Campfire Collective website. Unauthorized code capturing payment card information was present from Feb 15, 2024 to Nov 4, 2025. The company engaged third-party specialists, removed the code, and is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 627 days

discovery → filing · 7 weeks / 46 days

Feb 15, 2024

Begins

Nov 3, 2025

Discovered

Dec 19, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Nebraska State AGbd_11153afcf477000e2025-12-19Verified
Washington State AGbd_3168f9850d26a5b32025-12-19Candidate
Massachusetts State AGbd_653116e93e02f5ae2025-12-19Verified
Maine State AGbd_6c6eccc5335561c32025-12-19Verified

Show 4 more filings ↓up to 19d gap

California State AGbd_c828eb1df170a5992025-12-19Verified
Indiana State AGbd_fe40f045ec9e37c22025-12-19Verified
New Hampshire State AGbd_f53a3a1268dc51f02025-12-22 · +3dVerified
Texas State AGbd_8e546bbf2f3130132026-01-07 · +19dVerified by operator

Name: Outdoor Smart! Inc
norm: outdoor smart

Name: Outdoor Smart! Inc
norm: outdoor smart
Industry: Retail & Consumerllm

Discovered: Nov 3, 2025
Breach occurred: Feb 15, 2024 – Nov 4, 2025
Undetected for: 627 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: Not disclosed
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Initiated its incident response protocols
Engaged third-party cybersecurity specialists
Removed the unauthorized code
Providing 24 months of complimentary access to credit monitoring and identity restoration services through Epiq
Changes made: Reviewing its existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Nebraska State AGDec 19 · first

Washington State AGDec 19 · first

Massachusetts State AGDec 19 · first

Maine State AGDec 19 · first

California State AGDec 19 · first

Indiana State AGDec 19 · first

Vermont State AGDec 19 · first · this page

New Hampshire State AG+3d

Texas State AG+19d

Pattern: first filing Dec 19 (NE), last Jan 7 (TX) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-12-19-outdoor-smart-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: cd4b8336b1d4a36b729f21d7ee6bdf5a065137840c5ab010a45a728b3e93e354

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityOutdoor Smart! Inc

Victim entityOutdoor Smart! Inc

Incidentdiscovered Nov 3, 2025

Stated responseInitiated its incident response protocols

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov