P2018-ND-081

The Organization uses a third party service provider, Aptos, Inc., to provide e-commerce services enabling the Organization?s customers to order and purchase goods using an internet website.The Organization was informed of the breach in a letter dated February 7, 2017, from its service provider Aptos. Aptos reported to the Organization that it became aware of anomalous activity on its systems on or about November 28, 2016. Aptos investigated and found that the intrusion began in approximately February 2016 and ended in December 2016 (the Organization has used Aptos as a service provider since May 2016). Aptos reported the matter to the FBI Cyber Division and the U.S. Department of Justice. Aptos informed the Organization that the U.S. Department of Justice requested that Aptos delay notifying its clients about the potential data breach for at least 60 days.