HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Jofit

bd_0b9c86242d3026dd · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 15, 2017

Filed

Feb 22, 2017

To disclose

5 weeks

Affected

38state residents only

Linked

5 filings

Confidence

66%

Full breach record for Jofit →2 incidents on file

JoFit, a clothing and accessories company, notified the NH Attorney General in February 2017 that its website was targeted by a cybersecurity attack in mid-January 2017. The attack exploited a vulnerability in the website, potentially exposing customer names and credit card information. Approximately 38 New Hampshire residents were likely affected. JoFit engaged forensic consultants and notified law enforcement, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 38 days

Jan 15, 2017

Discovered

Feb 22, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_bf4943e430adc89c2017-02-22Candidate
Montana State AGbd_a5f19ba9a4ddaaf72017-02-24 · +2dVerified
South Carolina State AGbd_7e07236de8a43c272017-02-27 · +5dVerified
Massachusetts State AGbd_a1ceb2bc965190e32017-02-27 · +5dVerified

Name: SAUL EWING LLP
norm: saul ewing

Name: Jofit
norm: jofit
Domain: jofit.com
Industry: Retail & Consumerllm

Discovered: Jan 15, 2017
Materiality determined: —
Notification sent: Feb 23, 2017
Affected individuals: 38state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Engaged the services of an outside consultant to perform an independent investigation
Notified law enforcement
Hired an independent computer forensics consultant that specializes in cybersecurity
Engaged Epiq Corporate Services, Inc. to provide identity monitoring at no cost to you for one year
Changes made: Restored the integrity of the compromised database
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGFeb 22 · first

New Hampshire State AGFeb 22 · first · this page

Montana State AG+2d

South Carolina State AG+5d

Massachusetts State AG+5d

Pattern: first filing Feb 22 (CA), last Feb 27 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jofit-20170222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2017
Raw hash: b57748641c69de77d2d4d84b24b5012844cc284ad2c03fa2de6c654b0866ce54

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySAUL EWING LLP

Victim entityJofit

Incidentdiscovered Jan 15, 2017

Stated responseEngaged the services of an outside consultant to perform an independent investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov