DisclosureLens
AccidentalFinancial ServicesTechnologyFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Spark Pay Online Store

bd_f00cac85c9291409 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 6, 2017

To disclose

—

Affected

236state residents only

Linked

8 filings

Confidence

66%

Spark Pay Online Store, a division of Capital One, N.A., notified customers of a security event involving malicious code on merchant websites that allowed fraudsters to obtain payment information. The incident affected transactions between April 10, 2017, and June 7, 2017. Data involved included names, addresses, phone numbers, emails, and full payment card details (number, expiration, CVV). Capital One engaged law enforcement, notified card networks, and provided two years of free credit monitoring.

Incident timeline

Apr 10, 2017

Begins

Jul 6, 2017

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 103d gap

Filing propagation · 8 filings · 6 states

View merged incident ↗
New Hampshire State AGJul 6 · first
California State AGJul 6 · first
Montana State AGJul 6 · first · this page
Massachusetts State AG+1d
Oregon State AG+6d
New Hampshire State AG+102d
Washington State AG+102d
California State AG+103d

Pattern: first filing Jul 6 (NH), last Oct 17 (CA) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.