HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedPIIFinancial accountIdentity (basic)MediumContained

Easy Breathe, Inc.

bd_f6e58d89ec9258c1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 10, 2017

Filed

Mar 27, 2017

To disclose

6 weeks

Affected

2,034state residents only

Linked

6 filings

Confidence

68%

Full breach record for Easy Breathe, Inc. →

Easy Breathe, Inc. notified the Washington Attorney General of a data security incident discovered on February 10, 2017. An unknown individual accessed customer payment card information (names, addresses, phone numbers, credit/debit card details) via its online store. 2,034 Washington residents were affected. Notifications were mailed on March 27, 2017. The company engaged IT experts to secure the website and offered one year of identity repair services through AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Feb 10, 2017

Discovered

Mar 27, 2017

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_0ffdb705de61caaf2017-03-27Verified
Oregon State AGbd_30f914a5f01ddc412017-03-27Candidate
New Hampshire State AGbd_9a18ddc515f7c1912017-03-27Verified
Massachusetts State AGbd_c6c8a59de40209412017-03-27Verified

Show 1 more filing ↓up to 4d gap

South Carolina State AGbd_6a25382414ceb30b2017-03-31 · +4dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Easy Breathe, Inc.
norm: easy breathe
Domain: easybreathe.com
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Materiality determined: —
Notification sent: Mar 27, 2017
Affected individuals: 2,034state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged IT experts who have assisted Easy Breathe in securing its website, addressing possible vulnerabilities, and implementing continuous security monitoring of its website
Offered potentially impacted individuals identity repair services for one year, at no cost to the individual through AllClear ID
Provided notice to the credit reporting agencies
Changes made: Secured its website
Addressed possible vulnerabilities
Implemented continuous security monitoring of its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 27 · first

Oregon State AGMar 27 · first

New Hampshire State AGMar 27 · first

Massachusetts State AGMar 27 · first

Washington State AGMar 27 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9689.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2017
Raw hash: c46954ec33640e0a2aa44f8e54d6f652989fcceb0fc6158a6318f18f4e0fd0a3

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityEasy Breathe, Inc.

Incidentdiscovered Feb 10, 2017

Stated responseEngaged IT experts who have assisted Easy Breathe in securing its website, addressing possible vulnerabilities, and implementing continuous security monitoring of its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com