DisclosureLens
HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

Luxury Retreats

bd_065bf0a7254f68f4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2018

Filed

May 24, 2018

To disclose

9 weeks

Affected

2state residents only

Confidence

67%

Luxury Retreats notified the NH AG of a security incident where an unknown individual gained unauthorized access to an employee's corporate email account on March 22, 2018. The actor used the account to send spam. Customer PII (name, address, DOB, payment card, CVV, financial account, driver's license, passport) was present in the account. Only 2 NH residents were notified. No evidence of data misuse was found.

Incident timeline

discovery → filing · 9 weeks / 63 days

Mar 22, 2018

Discovered

May 24, 2018

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.