The Washington State Office of the Attorney General disclosed a data breach affecting Combat Brands, LLC, stemming from a cyberattack that persisted undetected between July 1, 2015, and October 6, 2017. The incident resulted in the compromise of payment card data for 956 individuals, including 753 Washington residents. Exposed information included cardholder names, card numbers, expiration dates, and CVV codes—critical details that could facilitate fraudulent transactions or identity theft. The breach highlights vulnerabilities in the company’s payment processing systems, allowing attackers prolonged access to sensitive financial data. While the exact method of infiltration (e.g., malware, phishing, or exploitation of unpatched systems) was not specified, the prolonged duration suggests a failure in detection mechanisms. The exposure of CVV codes—typically used for card-not-present transactions—increases the risk of unauthorized online purchases. Although no evidence of large-scale fraud was reported, the breach undermines customer trust and exposes the company to potential financial liabilities, regulatory penalties, and reputational damage. The incident underscores the need for robust payment security protocols, including encryption, tokenization, and real-time monitoring, to prevent similar compromises in the future.