[Date] [First_Name] [Last_Name] [ADDRESS_LINE_1] [ADDRESS_LINE_2] [Address_Line_3] [City], [State] [Zip] NOTICE OF DATA BREACH Dear [First_Name] [Last_Name], We are writing to inform you of a data security incident involving www.DiscountMugs.com. This letter outlines our current understanding of the incident, and measures we have taken to respond to the issue. What happened? On November 16, 2018, we discovered that an unauthorized change had been made to our DiscountMugs.com website. We immediately initiated an investigation and learned that unauthorized code was inserted into our shopping cart page designed to collect information customers entered on that page. We immediately removed the unauthorized code and reported the matter to law enforcement and to the payment card companies. On December 20, 2018, our investigation determined that orders placed by credit or debit cards between August 5, 2018 and November 16, 2018, may have been impacted by the unauthorized code. We are providing you with this notice because our records indicate that you placed an order between August 5, 2018 and November 16, 2018. What information was involved? The unauthorized code was designed to collect some information that customers submitted through the shopping cart page when completing an order, which may have included: name, address, phone number, email address, the credit card or debit card number used to place the order, the expiration date, and card security code (CVV2) for that card. Since we do not request PINs when debit cards are used, PINs were not subject to collection. What we are doing. As soon as we learned of this situation, we immediately launched an investigation and retained a leading computer security firm. We removed the unauthorized code from our website and took steps to strengthen our website’s security. We are also working with law enforcement and the payment card companies in their investigations of this matter. What you can do. Although we do not have any evidence that your information has been misused, we recommend that you review the information provided in the enclosed “Further Information and Steps You Can Take.” The enclosure identifies some steps you can take to guard against the misuse of your personal information. Additionally, we encourage you to remain vigilant for incidents of fraud on your payment card by reviewing your payment card statements regularly, and immediately report any suspicious activity to your card provider. Never provide personal information in a response to an electronic communication about a security event. As an added precaution, we have arranged to have AllClear ID protect your identity for 12 months at no cost to you. Please see the enclosure for additional information. For more information. We sincerely regret and apologize for any inconvenience this may cause you. Please do not hesitate to contact us at 855-300-1433 if you have any questions or concerns. Sincerely, Sai Koppaka CEO Enclosure: Further Information and Steps You Can Take BEL USA 12610 NW 115 Avenue, Medley, Florida 33178 U.S.A. Tel. 800 569-1980 Fax 305 591-9197 Further Information and Steps You Can Take We value our customer relationship, appreciate your business, and would like to provide as much assistance as we can. Therefore, as an added precaution, we have arranged to have AllClear ID (www.allclearid.com) provide you with identity protection services for 12 months at no cost to you. The following identity protection service start on the date of this notice and you can use them at any time during the next 12 months. AllClear Identity Repair: This service is automatically available to you with no enrollment required. If a problem arises, simply call 855-300-1433 and a dedicated investigator will help recover financial losses, restore your credit and make sure your identity is returned to its proper condition. AllClear Identity Theft Monitoring: This service offers additional layers of protection including identity theft monitoring that delivers secure, actionable alerts to you by phone and $1 million identity theft insurance coverage. To use this service, you will need to provide your personal information to AllClear ID. You may sign up online at enroll.allclearid.com or by phone by calling 855-300-1433 using the following redemption code [Individual Redemption Code]. Please note: Additional steps may be required by you in order to activate your phone alerts and monitoring options. Information from the Federal Trade Commission The Federal Trade Commission provides suggestions for actions in the event of identity theft at www.consumer.ftc.gov/features/feature-0014-identity-theft. You may also contact the Federal Trade Commission for more information toll-free at 1-877-ID-THEFT (438-4338) (TTY: 1-866-653-4261), or write Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. Obtaining a free credit report or placing a security freeze You may obtain a free copy of your credit report from each of the credit bureaus once a year by going to http://www.annualcreditreport.com online, or call toll free 877-322-8228. Hearing impaired consumers can access TDD service at 877-730-4104. You should monitor these reports. You may also place a security freeze on your credit report by contacting the credit bureaus as listed below. Equifax 888-766-0008 www.equifax.com P.O. Box 105788 Atlanta, GA 30348 Experian 888-397-3742 www.experian.com P.O. Box 9554 Allen, TX 75013 TransUnion 800-680-7289 www.transunion.com P.O. Box 6790 Fullerton, CA 92834 A security freeze will prevent new credit from being opened in your name without the use of a personal identification number or password that will be issued by the credit bureaus after you initiate the freeze. A security freeze will also prevent potential creditors from accessing your credit report without your authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, mortgages, employment, housing or other services. In order to place a security freeze, you may be required to provide the credit bureaus with information that identifies you, including your full name, social security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement. Credit bureaus may charge a fee to place, lift, or remove the security freeze. This fee varies by state and it is generally $5 to $20 per action or it may be waived if you are the victim of identity theft and you provide a valid police report. You must separately place a security freeze on your credit file with each credit reporting agency. Filing a Police Report for Suspicious Activity If you do find suspicious activity on the credit or debit card indicated in our notice to you or in your credit report, call your local police or sheriff’s office and file a police report of identity theft. Get a copy of the police report. You may need to give copies of the police report to creditors to clear up your records. In addition, you should report identity theft to your Attorney General and the Federal Trade Commission. For Iowa Residents: The Attorney General provides information about preventing identity theft at http://www.iowaattorneygeneral.gov. You may also contact the Iowa Attorney General by calling (515) 281-5926, or by mail at 1305 E. Walnut Street, Des Moines, IA 50319. For Maryland Residents: The Maryland Attorney General provides information regarding identity theft at http://www.oag.state.md.us/idtheft/index.htm. You may also contact the Identity Theft Unit at (410) 576-6491, by email at idtheft@oag.state.md.us, and by mail at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202. For North Carolina Residents: The North Carolina Attorney General provides information about preventing and avoiding identity theft at http://www.ncdoj.gov. You may also contact the North Carolina Department of Justice at (877) 566-7226, or by mail at 9001 Mail Service Center, Raleigh, NC 27699-9001.