MalwareRetail & ConsumerRetailRansomwareData ExfiltratedTargetedFinancial accountFinancial credentialsIdentity (basic)PIIMediumContained

LÍLLÉbaby

bd_f000fce9dfaaaa23 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2018

Filed

Aug 29, 2018

To disclose

13 weeks

Affected

1,557state residents only

Linked

5 filings

Confidence

69%

Full breach record for LÍLLÉbaby →

LILLEbaby notified Washington AG of a malware incident on its e-commerce platform affecting payment card data (names, numbers, CVVs) for customers from June 2016 to July 2018. 1,557 WA residents affected. Discovered June 2018. FBI and card brands notified. Forensics firm retained. Remediation included platform security upgrades and payment processor transition.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 730 days

discovery → filing · 13 weeks / 89 days

Jun 1, 2016

Begins

Jun 1, 2018

Discovered

Aug 29, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_42f139649d2cf0362018-08-29Verified
Oregon State AGbd_e6bf067828ae30522018-08-29Candidate
New Hampshire State AGbd_ec62da6a823fbd402018-08-29Verified
California State AGbd_f92a306617ed7da42018-08-29Verified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: LÍLLÉbaby
norm: lillebaby
Domain: lillebaby.com
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Jun 1, 2016 – Jul 9, 2018
Undetected for: 730 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2018
Affected individuals: 1,557state-resident count only
Data types: Financial accountFinancial credentialsIdentity (basic)PII
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation (“FBI”)Notified payment card brands
Initial access: exploit_public_facing

During the incident: Retained a leading forensics firm to determine what happened
Reported the matter to the Federal Bureau of Investigation (“FBI”)
Reported the matter to the payment card brands
Changes made: Working with a leading forensics firm to remove malicious code from the LÍLLÉbaby e-commerce web platform
Taken steps to increase the security of its e-commerce platform (Magento)
Transitioned to processing payment cards through Payflow Pro IFrame to bolster transaction security
Rebuilding its web platform in order to enhance the security of the payment card environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 29 · first

Oregon State AGAug 29 · first

New Hampshire State AGAug 29 · first

California State AGAug 29 · first

Washington State AGAug 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10578.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2018
Raw hash: 1009a3a792214e00006713e3787884b3b599b21b5772aa725b39ed15d16c6126

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityLÍLLÉbaby

Incidentdiscovered Jun 1, 2018

Stated responseRetained a leading forensics firm to determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com