Astral Brands

Summary

A beauty product company based in Atlanta suffered a cyberattack involving unauthorized network access, potentially exposing sensitive customer data including financial account details, Social Security numbers, driver’s license information, health insurance records, and medical information. The breach impacted 1,884 individuals and was discovered months after the initial intrusion; the organization contained the threat by disabling unauthorized access, restoring systems, and collaborating with external cybersecurity experts to investigate.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Astral Brands, a beauty product company based in Atlanta, Georgia, experienced a cybersecurity incident involving unauthorized network access that occurred around September 2022. The breach was discovered by the company on March 23, 2023, approximately six months after the initial intrusion. Upon detection, Astral Brands contained the threat by disabling all unauthorized access points and restoring affected systems. The company immediately initiated a thorough investigation into the incident and engaged external cybersecurity professionals with expertise in handling such breaches. This investigation aimed to determine the full scope and impact of the unauthorized activity on their network infrastructure.

The data breach potentially exposed sensitive personal and financial information belonging to 1,884 individuals. Compromised data elements included names, credit card numbers, financial account details, passwords, PINs, dates of birth, passport information, Social Security numbers, driver's license particulars, and health insurance or medical records. Astral Brands formally notified affected customers through individual breach notification letters, disclosing that the intrusion had resulted in potential exposure of maintained data. The company also reported the incident to authorities in Maine as part of regulatory compliance obligations. No additional technical details regarding attack vectors, threat actor identities, or specific system vulnerabilities were disclosed in the public notification. The organizational response focused on containment, system restoration, and investigative collaboration with cybersecurity experts following the discovery of the breach.

Sources

Sources available to members: 1 source.