Incipio, LLC

Summary

Incipio experienced a malware compromise affecting online orders via a cloud server, exposing customer names, addresses, contact details, and payment card information including CVV codes. The company offered identity protection services through Kroll to impacted individuals despite no confirmed fraud instances.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Incipio, LLC experienced a cybersecurity incident involving unauthorized access to customer data through malware installed on one of their cloud-based servers. The compromise was discovered on February 4, 2016, and affected online purchases made through www.incipio.com between September 26, 2015, and January 29, 2016. Chairman and CEO Andy Fathollahi stated that despite existing security controls, attackers infiltrated the system during this four-month period. The breach investigation confirmed that personal and financial information from customer transactions was accessed. While the specific method of initial intrusion wasn’t detailed, the compromise centered on a cloud server supporting the e-commerce platform. The company initiated an internal investigation upon discovery but did not disclose whether external forensic experts were engaged. No evidence suggested system access prior to September 26 or after January 29, establishing clear boundaries for the exposure window.

The compromised data included full names, physical addresses, phone numbers, email addresses, credit or debit card numbers, payment card expiration dates, and CVV security codes. Incipio explicitly stated they had no knowledge of any fraudulent activity stemming from the breach as of their notification date. The company offered affected customers complimentary identity protection services through Kroll, though enrollment specifics weren’t provided. Notifications were issued in February 2016 without disclosing the total number of impacted individuals. The incident exclusively affected customers who made online purchases during the specified timeframe, with no mention of compromised employee data or physical store transactions. Security improvements weren’t detailed in the notification beyond referencing existing “robust controls,” and no law enforcement involvement or regulatory filings were referenced in the available disclosure.

Sources

Sources available to members: 1 source.