MalwareRetail & ConsumerRetailRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Weekends Only, Inc.

bd_0b0b9e2c14bf5f32 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Mar 3, 2017

To disclose

17 weeks

Affected

180state residents only

Linked

2 filings

Confidence

66%

Full breach record for Weekends Only, Inc. →

Weekends Only, Inc. filed a supplemental notice with the NH Attorney General regarding a security incident at third-party e-commerce host Aptos, Inc. The intrusion, active from Feb 2016 to Dec 2016, exposed customer PII and payment card data. 180 NH residents were notified starting March 3, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 17 weeks / 122 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Mar 3, 2017

Filed

vs. sector median

+9 wks slower

This filing is one of 2 about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c255d3d018d206e92017-03-07 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Weekends Only, Inc.
norm: weekends only
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 3, 2017
Affected individuals: 180state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the U.S. Department of Justice
Initial access: external_remote_services

During the incident: Notified the FBI and the U.S. Department of Justice
Worked with a leading cybersecurity firm to remove the malware from its systems
Made security updates to the systems
Strengthened access controls
Changes made: Strengthened access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(122 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMar 3 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/weekends-only-20170303.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2017
Raw hash: 5164b2d3133876ba5a9cd9d123fa0f1adeedba1b598c122643e716061a44b3cd

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityWeekends Only, Inc.

Incidentdiscovered Nov 1, 2016

Stated responseNotified the FBI and the U.S. Department of Justice

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov