HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedAuthenticationFinancial accountIdentity (basic)PIILowContained

First Aid Beauty

bd_f8a5c17831a5c8b3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 21, 2019

Filed

Nov 8, 2019

To disclose

11 weeks

Affected

663state residents only

Linked

5 filings

Confidence

70%

Full breach record for First Aid Beauty →

First Aid Beauty Limited notified the Washington AG of a cyberattack where malicious code was placed on firstaidbeauty.com between April 15 and October 25, 2019. The code enabled unauthorized access to customer names, addresses, and payment card info. 663 Washington residents were affected. The company took the site offline, engaged forensic experts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 128 days

discovery → filing · 11 weeks / 79 days

Apr 15, 2019

Begins

Aug 21, 2019

Discovered

Nov 8, 2019

Filed

vs. sector median

+4 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_615fc4de84c079222019-11-08Candidate
Massachusetts State AGbd_97292813f8a3c8f82019-11-08Verified
California State AGbd_da211918bbf1b9ac2019-11-08Verified
Montana State AGbd_db3165362653ad5b2019-11-08Verified by operator

Name: First Aid Beauty
norm: first aid beauty
Domain: firstaidbeauty.com

Name: First Aid Beauty
norm: first aid beauty
Domain: firstaidbeauty.com
Industry: Retail & Consumerllm

Discovered: Aug 21, 2019
Breach occurred: Apr 15, 2019 – Oct 25, 2019
Undetected for: 128 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2019
Affected individuals: 663state-resident count only
Data types: AuthenticationFinancial accountIdentity (basic)PII
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoing
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Blocked the malicious code
Took firstaidbeauty.com offline
Engaged a leading data security expert to conduct a forensic investigation
Removed the malicious code
Offering complimentary credit monitoring to affected individuals
Changes made: Offered complimentary credit monitoring through Experian for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGNov 8 · first

Massachusetts State AGNov 8 · first

California State AGNov 8 · first

Montana State AGNov 8 · first

Washington State AGNov 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10516.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2019
Raw hash: b6e7821ef8cdad2dbd0e7dcd48fc8f5a2016f19ebe989973e9e50d0167da633a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFirst Aid Beauty

Victim entityFirst Aid Beauty

Incidentdiscovered Aug 21, 2019

Stated responseBlocked the malicious code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com