HackingTechnologyInformationVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

RegistratioNATION

bd_13f0f009d350e646 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 22, 2013

Filed

Dec 23, 2013

To disclose

4 weeks

Affected

26state residents only

Linked

2 filings

Confidence

66%

Full breach record for RegistratioNATION →

RegistratioNATION notified 26 New Hampshire residents that their personal information (names, DOB, credit/debit card numbers, verification codes, billing addresses) was accessed following a cyber-attack on November 4, 2013. The company discovered the incident on November 22, 2013, and filed a report with the FBI IC3. Notifications were mailed on December 30, 2013. The company engaged forensic investigators and removed malicious code.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 18 days

discovery → filing · 4 weeks / 31 days

Nov 4, 2013

Begins

Nov 22, 2013

Discovered

Dec 23, 2013

Filed

vs. sector median

6 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_159669bd0ea62e922013-12-27 · +4dVerified

Name: RegistratioNATION
norm: registrationation
Domain: registrationation.com

Name: RegistratioNATION
norm: registrationation
Domain: registrationation.com
Industry: Technologyllm

Discovered: Nov 22, 2013
Breach occurred: Nov 4, 2013
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2013
Affected individuals: 26state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed a complaint with the Federal Bureau of Investigation’s Internet Crime Complaint CenterNotified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Working with a third-party forensics firm to conduct a thorough investigation
Ensuring that all credit card information submitted through its website is collected and handled by its third party payment processor and not stored on its server
Removal of the malicious code
Filed a complaint with the Federal Bureau of Investigation’s Internet Crime Complaint Center
Mailing notification to affected New Hampshire residents
Changes made: Ensuring that all credit card information submitted through its website is collected and handled by its third party payment processor and not stored on its server
Removal of the malicious code
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 23 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/registrationation-20131223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2013
Raw hash: 9cb840caa636f74ccfcb0a1fc1be4d8847a25f97e8c0e8335502e5f6bc58b9b6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRegistratioNATION

Victim entityRegistratioNATION

Incidentdiscovered Nov 22, 2013

Stated responseWorking with a third-party forensics firm to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov