MalwareRetail & ConsumerRetailRansomwareData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

Blue Mercury, Inc.

bd_fe64d7935ba61d09 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 28, 2016

Filed

Feb 25, 2017

To disclose

13 weeks

Affected

778state residents only

Confidence

68%

Full breach record for Blue Mercury, Inc. →

Blue Mercury, Inc. notified Washington AG of a breach affecting 778 residents. Attackers placed malware on third-party provider Aptos' servers between Feb 2016 and Dec 2016, accessing names, addresses, phone numbers, and payment card data. Bluemercury ended its relationship with Aptos and offered identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 276 days

discovery → filing · 13 weeks / 89 days

Feb 26, 2016

Begins

Nov 28, 2016

Discovered

Feb 25, 2017

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed778 affectedView incident

Name: Aptos, Inc.
norm: aptos

Name: Blue Mercury, Inc.
norm: blue mercury
Industry: Retail & Consumerllm

Discovered: Nov 28, 2016
Breach occurred: Feb 26, 2016 – Dec 5, 2016
Undetected for: 276 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2017
Affected individuals: 778state-resident count only
Data types: Identity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Reported matter to the FBI and the U.S. Department of Justice
Initial access: exploit_public_facing

During the incident: Aptos has worked with a leading cybersecurity firm to remove the malware from its systems
Aptos contacted and offered its cooperation to federal law enforcement
Aptos provided Individual Consumer contact information to affected Retailers
Steps were taken to supply the numbers of affected cards to their issuers for monitoring
Changes made: Strengthening access controls
End relationship with Aptos
Instructed Aptos to destroy any and all remaining Bluemercury client data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9677.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2017
Raw hash: 682699cfca686da6a683cbb6f73133a9357091e57efbab0e5ffb00160aa92446

Reporting entityAptos, Inc.

Victim entityBlue Mercury, Inc.

Incidentdiscovered Nov 28, 2016

Stated responseAptos has worked with a leading cybersecurity firm to remove the malware from its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com