HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountAuthenticationLowContained

Munro and Company, Inc.

bd_140ba4b3babb2011 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 9, 2018

Filed

Aug 22, 2018

To disclose

13 days

Affected

3state residents only

Confidence

66%

Full breach record for Munro and Company, Inc. →

Munro and Company, Inc. notified the NH AG of a security incident where an unauthorized individual accessed the credit card processing website. Data accessed included names, payment card numbers, expiration dates, and security codes for transactions between July 21 and August 8, 2018. 3 NH residents were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 19 days

discovery → filing · 13 days

Jul 21, 2018

Begins

Aug 9, 2018

Discovered

Aug 22, 2018

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Munro and Company, Inc.
norm: munro and

Name: Munro and Company, Inc.
norm: munro and
Industry: Retail & Consumerllm

Discovered: Aug 9, 2018
Breach occurred: Jul 21, 2018 – Aug 8, 2018
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Began an investigation
Hired a third-party forensic firm
Changes made: Enhance their existing security protocols
Implementing robust data security procedures to prevent future unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/munro-20180822.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2018
Raw hash: 6398fa77a9513bd33e485895772b13f1e86e2ec4d10e8db401f12809d95cb363

Reporting entityMunro and Company, Inc.

Victim entityMunro and Company, Inc.

Incidentdiscovered Aug 9, 2018

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov