DisclosureLens
HackingFinancial ServicesTechnologyFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Spark Pay Online Store

bd_f649ec3a6914c853 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 6, 2017

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Spark Pay Online Store, a division of Capital One, N.A., disclosed a security event involving malicious code on a merchant website hosted by Spark Pay. The code allowed fraudsters to obtain customer payment information, including name, address, phone number, email, payment card number, expiration date, and CVV, for transactions made between April 10, 2017, and June 7, 2017. The company removed the code, notified card networks and law enforcement, and offered two years of credit monitoring.

Incident timeline

Apr 10, 2017

Begins

Jul 6, 2017

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 103d gap

Filing propagation · 8 filings · 6 states

View merged incident ↗
New Hampshire State AGJul 6 · first
Montana State AGJul 6 · first
California State AGJul 6 · first · this page
Massachusetts State AG+1d
Oregon State AG+6d
New Hampshire State AG+102d
Washington State AG+102d
California State AG+103d

Pattern: first filing Jul 6 (NH), last Oct 17 (CA) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.