HackingRetail & ConsumerRetailStolen CredentialsTargetedData ExfiltratedIdentity (basic)Financial accountAuthenticationLowContained

NUTRITIONAL MEDICINALS, LLC

bd_078d555aed80e1b4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 25, 2021

Filed

Jun 21, 2021

To disclose

13 weeks

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for NUTRITIONAL MEDICINALS, LLC →

Nutritional Medicinals, LLC notified the NH AG of a data event affecting 3 NH residents. Malicious code on their online store captured payment card info entered between Jan 18 and Apr 14, 2021. Discovered March 25, 2021. Notices sent June 14, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 66 days

discovery → filing · 13 weeks / 88 days

Jan 18, 2021

Begins

Mar 25, 2021

Discovered

Jun 21, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_1138a855d0e0ea2a2021-06-14 · +7dCandidate
Indiana State AGbd_9e9473616d99173d2021-06-14 · +7dVerified
Massachusetts State AGbd_ead9f483238d155f2021-06-14 · +7dVerified

Name: NUTRITIONAL MEDICINALS, LLC
norm: nutritional medicinals
Domain: functionalformularies.com

Name: NUTRITIONAL MEDICINALS, LLC
norm: nutritional medicinals
Domain: functionalformularies.com
Industry: Retail & Consumerllm

Discovered: Mar 25, 2021
Breach occurred: Jan 18, 2021 – Apr 14, 2021
Undetected for: 66 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation, with the assistance of third-party forensic specialists
Provided access to credit monitoring services for two (2) years, through Kroll
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
The malicious code has been removed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(88 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 14 · first

Indiana State AGJun 14 · first

Massachusetts State AGJun 14 · first

New Hampshire State AG+7d · this page

Pattern: first filing Jun 14 (ME), last Jun 21 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nutritional-medicinals-20210621.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2021
Raw hash: 41a79d83445f32182d068dea1abbb714e7b4414c696ea6a3f25198dca098a6f1

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNUTRITIONAL MEDICINALS, LLC

Victim entityNUTRITIONAL MEDICINALS, LLC

Incidentdiscovered Mar 25, 2021

Stated responseLaunched an investigation, with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov