HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

onia

bd_fd85b4bf24f8997c · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 11, 2017

Filed

Jun 8, 2017

To disclose

8 weeks

Affected

2state residents only

Linked

2 filings

Confidence

65%

Full breach record for onia →

Onia notified customers of a data breach involving its e-commerce provider, Acadaca, LLC. Malicious code captured customer personal and financial data (names, addresses, credit card numbers, CVVs) from Nov 12, 2016 to Apr 11, 2017. The FBI was notified. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 150 days

discovery → filing · 8 weeks / 58 days

Nov 12, 2016

Begins

Apr 11, 2017

Discovered

Jun 8, 2017

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9d06dedc13266bcb2017-06-06 · +2dVerified

Name: onia
Domain: onia.com

Name: onia
Domain: onia.com
Industry: Retail & Consumerllm

Discovered: Apr 11, 2017
Breach occurred: Nov 12, 2016 – Apr 11, 2017
Undetected for: 150 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 6, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Acadaca has reported this incident to the Federal Bureau of InvestigationOnia has notified the applicable state agencies
Third party: via Acadaca, LLC
Initial access: phishing_link

During the incident: Malicious code was removed within hours
Acadaca began an investigation into the unauthorized access
Acadaca has reported this incident to the Federal Bureau of Investigation
Onia has notified the applicable state agencies
Reviewing both Acadaca’s and our own security procedures and practices
Changes made: Reviewing both Acadaca’s and our own security procedures and practices to minimize the risk of recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 6 · first

Montana State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Onia.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2017
Raw hash: d9b81b5823ed30f5115a59f9a5fea4d374567c06b1f0aba4fadaa5b4e70e5e19

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityonia

Victim entityonia

Incidentdiscovered Apr 11, 2017

Stated responseMalicious code was removed within hours

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov