Social EngineeringRetail & ConsumerRetailPhishingEmployee Data InvolvedEmploymentFinancial accountIdentity (basic)Government IDMediumContained

Advance Auto Parts, Inc.

bd_fd971bcf70ef33ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2016

Filed

Mar 15, 2016

To disclose

8 days

Affected

544state residents only

Linked

6 filings

Confidence

69%

Full breach record for Advance Auto Parts, Inc. →2 incidents on file

Advance Auto Parts reported a phishing attack on March 7, 2016, where an employee was tricked into providing a file containing PII of other employees. The breach exposed names, SSNs, 2015 gross wages, and tax states for 544 Washington residents. Advance Auto Parts notified law enforcement and provided 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

Mar 7, 2016

Begins

Mar 7, 2016

Discovered

Mar 15, 2016

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_9cbe6906ec7bb21c2016-03-16 · +1dVerified
Massachusetts State AGbd_bda8f85a7b59f0f02016-03-16 · +1dVerified
Montana State AGbd_3cce9ac72fde297a2016-03-17 · +2dVerified
South Carolina State AGbd_413e38d96c01b2a12016-03-17 · +2dVerified

Show 1 more filing ↓up to 30d gap

Oregon State AGbd_061f86f700c416db2016-04-14 · +30dVerified

Name: Advance Auto Parts, Inc.
norm: advance auto parts

Name: Advance Auto Parts, Inc.
norm: advance auto parts
Industry: Retail & Consumerllm

Discovered: Mar 7, 2016
Breach occurred: Mar 7, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2016
Affected individuals: 544state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Financial account numberSocial Security numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: phishing_link

During the incident: Notified federal law enforcement of this incident, requesting that they investigate fully
Communicating to all relevant current and former employees
Offering free identity protection services and hotline support
Engaged AllClear ID to provide identity protection services for 24 months at no cost
Changes made: Assessing any additional actions needed to protect employee information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGMar 15 · first · this page

California State AG+1d

Massachusetts State AG+1d

Montana State AG+2d

South Carolina State AG+2d

Oregon State AG+30d

Pattern: first filing Mar 15 (WA), last Apr 14 (OR) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 15, 2016
Raw hash: e542c7d0bab427e4d36bf8d695c03617f7641206ec5777ed9b679c4e1ea6a2d3

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAdvance Auto Parts, Inc.

Victim entityAdvance Auto Parts, Inc.

Incidentdiscovered Mar 7, 2016

Stated responseNotified federal law enforcement of this incident, requesting that they investigate fully

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com