Cyber Incident Victim: Wilson's Gun Shop, Inc.

On September 8, 2022, Wilson’s Gun Shop, Inc., a firearm manufacturer based in Berry, Arkansas, publicly confirmed a data breach involving unauthorized access to sensitive consumer information. The breach compromised names, addresses, and financial account details—including credit/debit card numbers, expiration dates, and CVV codes—of individuals who had interacted with the company, though Wilson Combat did not explicitly confirm whether affected parties were exclusively online customers. Initial reporting indicated the incident impacted at least 13,522 Texas residents, though the total scope beyond Texas remained unconfirmed at the time of disclosure. The company had not yet issued data breach notifications to affected individuals but stated such notices would be distributed via U.S. mail in the coming weeks, consistent with Texas breach notification laws requiring disclosure within 60 days of discovery unless law enforcement investigations necessitate delays. Wilson Combat, founded in 1977 and employing over 200 people with approximately $79 million in annual revenue, did not disclose the timeline of the breach discovery, the duration of unauthorized access, or whether law enforcement was involved in investigating the incident.

The breach exposed financial data highly susceptible to fraud, though no specific instances of misuse were reported in the initial filing. Wilson Combat’s public disclosure, made through a filing with the Texas Attorney General, provided no details regarding containment measures, system remediation, or forensic findings about the intrusion method. Potential causes referenced in general breach analysis included malware attacks designed to exfiltrate data, ransomware incidents where encrypted data might be leaked if ransoms were unpaid, or data scraping attacks involving malicious code injected into e-commerce platforms to harvest payment details during transactions. The company did not confirm whether any of these methods were employed or whether third-party vendors or internal systems were implicated. Impacted individuals were advised to await formal notifications for confirmation of their compromised data, with no immediate remediation services such as credit monitoring disclosed in the filing. Texas breach reporting requirements obligated the company to specify the number of affected state residents but did not mandate disclosure of technical attack vectors or operational disruptions resulting from the incident.