In breach notification documents filed this week in California and Maine, SelectBlinds said employees discovered the malware on September 28 and realized the malware had been on the company website since at least January 7.