HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsMediumActive

SwimwearBoutique.com

bd_10303d66c20283dc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2008

Filed

Apr 16, 2008

To disclose

19 days

Affected

312state residents only

Linked

2 filings

Confidence

64%

Full breach record for SwimwearBoutique.com →

SwimwearBoutique.com notified the NH Attorney General of a criminal intrusion discovered on March 28, 2008. Unauthorized access occurred between March 26 and 28, 2008, affecting approximately 312 New Hampshire residents. Data accessed included names, addresses, credit card numbers, and passwords. The company engaged the Secret Service and McAfee, implemented security measures, and offered one year of identity protection services. Notification letters were scheduled for April 23, 2008.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 19 days

Mar 26, 2008

Begins

Mar 28, 2008

Discovered

Apr 16, 2008

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_962c34922eb0e03a2008-04-22 · +6dVerified

Name: SwimwearBoutique.com
norm: swimwearboutiquecom

Name: SwimwearBoutique.com
norm: swimwearboutiquecom
Industry: Retail & Consumerllm

Discovered: Mar 28, 2008
Breach occurred: Mar 26, 2008 – Mar 28, 2008
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 23, 2008
Affected individuals: 312state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Reported the crime to the United States Secret Service
Worked with Internet security provider, McAfee, to determine how criminals gained access
Implemented measures to counter such unlawful conduct
Monitoring the site for further attempts to break into the site
Continued to work with McAfee to maintain the security of the site
Notified merchant bank and cooperating to provide a list of affected individuals
Changes made: Offering a year's subscription to LoudSiren Identity Protection Network to affected customers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 16 · first · this page

Massachusetts State AG+6d

Pattern: first filing Apr 16 (NH), last Apr 22 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/swimwear-boutique-20080416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2008
Raw hash: 914270e5f30fea8594dafd3442963a67b0cccc8a371163fa2cc85ed7f9ccc62f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySwimwearBoutique.com

Victim entitySwimwearBoutique.com

Incidentdiscovered Mar 28, 2008

Stated responseReported the crime to the United States Secret Service

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov