HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Mama Mio

bd_edb49df625b20e04 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 28, 2015

Filed

Aug 4, 2015

To disclose

7 days

Affected

Not disclosed

Confidence

65%

Full breach record for Mama Mio →

Mama Mio US, Inc. disclosed a cyber-attack on its website (mioskincare.com) affecting customers who ordered between April 29 and July 28, 2015. The incident was discovered on July 28, 2015. Compromised data included names, emails, addresses, phone numbers, and full credit/debit card details (number, expiry, CVV). The company engaged forensic investigators, notified credit card issuers, and reported to UK regulators (ICO, Action Fraud) and the California State Regulator. No specific malware family or threat actor was named.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 90 days

discovery → filing · 7 days

Apr 29, 2015

Begins

Jul 28, 2015

Discovered

Aug 4, 2015

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mama Mio
norm: mama mio
Domain: mamamiouk.com

Name: Mama Mio
norm: mama mio
Domain: mamamiouk.com
Industry: Retail & Consumerllm

Discovered: Jul 28, 2015
Breach occurred: Apr 29, 2015 – Jul 28, 2015
Undetected for: 90 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Information Commissioner's Office of the breachNotified Action Fraud (The National Fraud and Cyber Crime Reporting Centre) in the UKNotified your State Regulator
Initial access: exploit_public_facing

During the incident: Commissioned a forensic team to locate the malware, identify the compromised data and prevent any further loss
Notified all relevant credit card companies
Notified the acquiring bank who will be contacting all the relevant credit and debit card issuers
Notified the Information Commissioner's Office of the breach
Notified Action Fraud (The National Fraud and Cyber Crime Reporting Centre) in the UK
Notified your State Regulator
Changes made: Taken considerable steps to ensure that our website is a safe environment for customers to continue shopping online in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-57280
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2015
Raw hash: 102a70990092230a0e6c5884f375bde25a8806383571cc02303d522798cfba54

Reporting entityMama Mio

Victim entityMama Mio

Incidentdiscovered Jul 28, 2015

Stated responseCommissioned a forensic team to locate the malware, identify the compromised data and prevent any further loss

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov