DisclosureLens
HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryFinancial accountCredentialsIdentity (basic)LowContained

The NOCO Company

bd_09da81db733948c9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 23, 2021

Filed

May 18, 2021

To disclose

8 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%
Full breach record for The NOCO Company →

The NOCO Company identified malicious code on its website (no.co) on March 23, 2021, which allowed an unauthorized party to access payment card information, names, usernames, and passwords of customers who made purchases between October 8, 2019, and March 23, 2021. The company removed the code, engaged a cybersecurity firm, reset passwords, and implemented additional security controls.

California clockDiscovered Mar 23, 2021 → Notified May 17, 202155d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 532 days
discovery → filing · 8 weeks / 56 days

Oct 8, 2019

Begins

Mar 23, 2021

Discovered

May 18, 2021

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Show 1 more filing ↓

Filing propagation · 6 filings · 6 states

View merged incident ↗
Montana State AGMay 18 · first
Indiana State AGMay 18 · first
New Hampshire State AGMay 18 · first
Maine State AGMay 18 · first
Massachusetts State AGMay 18 · first
California State AGMay 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.