HackingRetail & ConsumerRetailSkimmerStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsCredentialsLowContained

eImprovement, LLC

bd_fc00888d37865414 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2020

Filed

Mar 25, 2020

To disclose

7 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for eImprovement, LLC →

eImprovement, LLC (operator of eFaucets.com) experienced a breach where malicious scripts copied checkout data (names, addresses, credit card numbers, CVVs) and exfiltrated it to an external domain. The attack vector was identified as a skimmer on the public-facing website. The breach occurred on or after December 14, 2019, and was discovered on February 3, 2020, following a customer report of fraud. The company disabled card processing, removed the scripts, reported the incident to the FBI, and offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 7 weeks / 51 days

Dec 14, 2019

Begins

Feb 3, 2020

Discovered

Mar 25, 2020

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: eImprovement, LLC
norm: eimprovement
Domain: efaucets.com

Name: eImprovement, LLC
norm: eimprovement
Domain: efaucets.com
Industry: Retail & Consumerllm

Discovered: Feb 3, 2020
Breach occurred: Dec 14, 2019
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported this security incident to the FBI
Initial access: exploit_public_facing

During the incident: Disabled use of all debit and credit cards on eFaucets.com
Removed the offending scripts from our database
Reported this security incident to the FBI
Secured the services of Kroll to provide identity monitoring at no cost to you for one (1) year
Changes made: Made the business decision not to resume debit and credit card transactions on eFaucets.com
Offered customers the choice of using PayPal or placing their order over the phone
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-188609
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2020
Raw hash: e5a7c4868ea86f2a9dca99a739092c118817eab0d51a94a9be80f861e3988ccb

Reporting entityeImprovement, LLC

Victim entityeImprovement, LLC

Incidentdiscovered Feb 3, 2020

Stated responseDisabled use of all debit and credit cards on eFaucets.com

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov