HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Alton Lane Inc.

bd_099c15f6a06ff51a · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2017

Filed

Jan 10, 2018

To disclose

10 weeks

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for Alton Lane Inc. →

Alton Lane Inc. notified the NH Attorney General of a data breach affecting 5 NH residents. Malicious code injected in Nov 2016 allowed unauthorized access to personal and financial info (names, addresses, credit cards) via its website from Nov 2016 to Nov 2017. Alton Lane removed the code, secured the checkout process, and hired a third-party auditor.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 365 days

discovery → filing · 10 weeks / 70 days

Nov 1, 2016

Begins

Nov 1, 2017

Discovered

Jan 10, 2018

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2005ee438da6d1d92018-01-10Verified
Montana State AGbd_3134e18a41e0d6572018-01-10Candidate

Name: THE WILLIAMS COMPANIES, INC.
norm: the williams companies
Domain: williams.com

Name: Alton Lane Inc.
norm: alton lane
Industry: Retail & Consumerllm

Discovered: Nov 1, 2017
Breach occurred: Nov 1, 2016 – Nov 1, 2017
Undetected for: 365 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2018
Affected individuals: 5state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Removal of the malicious code from its database
Further securing the e-commerce checkout process
Hiring a third party security agency to audit its systems
Enhancing procedures to maximize the security of its IT infrastructure and systems
Changes made: Further securing the e-commerce checkout process
Enhancing procedures to maximize the security of its IT infrastructure and systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 10 · first

Montana State AGJan 10 · first

New Hampshire State AGJan 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alton-lane-20180110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2018
Raw hash: 089bc9ec5e70e542a4ea4ece7e042e529d81b2bb94edc706fc4e6bd02f52fbeb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTHE WILLIAMS COMPANIES, INC.

Victim entityAlton Lane Inc.

Incidentdiscovered Nov 1, 2017

Stated responseRemoval of the malicious code from its database

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov