HackingRetail & ConsumerRetailSQL InjectionCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Crago, Inc

bd_f2f868d305ec57e0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 5, 2024

Filed

Feb 1, 2024

To disclose

27 days

Affected

75state residents only

Linked

5 filings

Confidence

65%

Full breach record for Crago, Inc →

Crago, Inc. d/b/a PrintingCenterUSA notified Montana residents of a data security incident where unauthorized third parties captured credit card information entered on the company website between September 27, 2023, and November 23, 2023. The company discovered the incident on January 5, 2024, engaged its incident response team, and notified law enforcement. Affected data included names, addresses, and full credit card details. The company is offering 24 months of free credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 100 days

discovery → filing · 27 days

Sep 27, 2023

Begins

Jan 5, 2024

Discovered

Feb 1, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_8ec0079895e1f9282024-02-01Verified
Indiana State AGbd_aa19d615c18c06082024-01-31 · +1dVerified
Maine State AGbd_b9ecc7177e10b9e52024-01-31 · +1dCandidate
New Hampshire State AGbd_5b981c443cc8aaf12024-01-30 · +2dVerified

Name: Crago, Inc
norm: crago

Name: Crago, Inc
norm: crago
Also named: Crago, Inc.dba oflegal entity
PrintingCenterUSAdba oftrade name
Industry: Retail & Consumerllm

Discovered: Jan 5, 2024
Breach occurred: Sep 27, 2023 – Nov 23, 2023
Undetected for: 100 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 31, 2024
Affected individuals: 75state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: notified credit card brands and law enforcement
Initial access: exploit_public_facing

During the incident: Engaged our incident response team
Notified credit card brands and law enforcement
Stopped any unauthorized access
Engaged our incident response team and data security professionals and experts to assist
Changes made: Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for twenty-four (24) months
Providing you with assistance to help with any questions that you might have about the Matter
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGJan 30 · first

Indiana State AG+1d

Maine State AG+1d

Massachusetts State AG+2d

Montana State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1068.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2024
Raw hash: 57660f3557a782244e7243949f36ca2438382acb9f07e56bbc2c54f8ff01b2b1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCrago, Inc

Victim entityCrago, Inc

Incidentdiscovered Jan 5, 2024

Stated responseEngaged our incident response team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov