HackingTechnologyInformationVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Keith Fabry

bd_f93673c01809f56b · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 31, 2020

Filed

Oct 9, 2020

To disclose

6 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Keith Fabry →

Keith Fabry disclosed that an unknown party gained unauthorized access to his website, PDFPlotting.com, between February 27, 2020, and August 9, 2020. The incident was discovered on August 31, 2020. Affected data may include names, addresses, and credit/debit card information. The company engaged a cybersecurity firm, removed the vulnerability, switched hosting providers, and offered one year of credit monitoring to affected consumers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 186 days

discovery → filing · 6 weeks / 39 days

Feb 27, 2020

Begins

Aug 31, 2020

Discovered

Oct 9, 2020

Filed

vs. sector median

13 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_238a781c7e392f332020-10-09Verified
New Hampshire State AGbd_a81f29b2fa6090862020-10-09Verified
Montana State AGbd_097d27a520e0ef102020-10-05 · +4dCandidate
Indiana State AGbd_830d0cd709cd93392020-10-05 · +4dVerified

Show 1 more filing ↓up to 4d gap

Maine State AGbd_d6a273e7bd007d0a2020-10-05 · +4dVerified

Name: Keith Fabry
norm: keith fabry
Domain: keithfabry.com

Name: Keith Fabry
norm: keith fabry
Domain: keithfabry.com
Industry: Technologyllm

Discovered: Aug 31, 2020
Breach occurred: Feb 27, 2020 – Aug 9, 2020
Undetected for: 186 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Contacted the third-party website host provider regarding the data security incident
Engaged a specialized cybersecurity firm to conduct a forensic investigation
Changes made: Identified and removed the security vulnerability that led to the compromise
Ran further scans to confirm that no additional threats or vulnerabilities posed a threat
Moved to a new website hosting service provider to further enhance security
Arranged for one year of online credit monitoring service (myTrueIdentity) provided by TransUnion Interactive
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 5 · first

Indiana State AGOct 5 · first

Maine State AGOct 5 · first

Massachusetts State AG+4d

New Hampshire State AG+4d

California State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194952
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2020
Raw hash: 8b18643b1d892f75a1ca50ab6e2b0a7991523e3afadb445b5160e4d61e2b32ed

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityKeith Fabry

Victim entityKeith Fabry

Incidentdiscovered Aug 31, 2020

Stated responseContacted the third-party website host provider regarding the data security incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov