MalwareRetail & ConsumerTechnologyRetailRansomwareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedDelayed DiscoveryIdentity (basic)Financial accountLowActive

Affy Tapple LLC

bd_f290b253be35eb08 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Mar 10, 2017

To disclose

18 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Affy Tapple LLC →2 incidents on file

Supplemental state AG notice from Affy Tapple LLC regarding the Aptos, Inc. third-party payment platform breach. Unauthorized access and malware placement occurred Feb-Dec 2016. Affected NH residents' names, addresses, emails, phone numbers, and payment card numbers. 1 NH customer impacted. Aptos discovered breach in Nov 2016 but delayed notification per law enforcement request.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 18 weeks / 129 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Mar 10, 2017

Filed

vs. sector median

+10 wks slower

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Affy Tapple LLC
norm: affy tapple

Name: Affy Tapple LLC
norm: affy tapple
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 31, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 8, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: asked by law enforcement investigating the incident to delay notification
Third party: via Aptos, Inc.
Initial access: supply_chain

During the incident: Worked with a leading cybersecurity firm to remove the malware
Made security updates
Strengthened access controls
Monitoring its systems to further safeguard customer information
Contacted and offered its cooperation to federal law enforcement
Offering free credit monitoring services
Changes made: Made security updates
Strengthened access controls
Monitoring its systems to further safeguard customer information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aptos-20170310.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2017
Raw hash: 099808c83be31bff11f723858da8ff2d67c21a9a86d061a348a0e48bf471de29

Reporting entityAffy Tapple LLC

Victim entityAffy Tapple LLC

Incidentdiscovered Nov 1, 2016

Stated responseWorked with a leading cybersecurity firm to remove the malware

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov