HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)PIILowContained

ANDREWS MCMEEL UNIVERSAL

bd_158262a5611d6690 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 19, 2022

Filed

Jul 25, 2023

To disclose

35 weeks

Affected

11state residents only

Linked

4 filings

Confidence

65%

Full breach record for ANDREWS MCMEEL UNIVERSAL →2 incidents on file

Supplemental notice to NH AG regarding Andrews McMeel Universal data incident. Unauthorized access occurred Nov 17-19, 2022. 11 NH residents affected. Personal info (name, etc.) compromised. AMU engaged forensic experts, notified law enforcement, offered credit monitoring/identity protection. Incident status: contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 35 weeks / 248 days

Nov 17, 2022

Begins

Nov 19, 2022

Discovered

Jan 4, 2023

Scope determined

Jul 25, 2023

Filed

vs. sector median

+27 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_3ceecdeb04a17faa2023-07-24 · +1dCandidate
Vermont State AGbd_49ac7deed0cc3dac2023-07-24 · +1dVerified
Maine State AGbd_d22c616e9c4f80952023-07-24 · +1dVerified by operator

Name: ANDREWS MCMEEL UNIVERSAL
norm: andrews mcmeel universal

Name: ANDREWS MCMEEL UNIVERSAL
norm: andrews mcmeel universal
Industry: Retail & Consumerllm

Discovered: Nov 19, 2022
Breach occurred: Nov 17, 2022 – Nov 19, 2022
Undetected for: 2 daysoccurrence → discovery
Materiality determined: Jan 4, 2023
Notification sent: Jul 24, 2023
Affected individuals: 11state-resident count only
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged cybersecurity experts to assist with safely restoring operations, to investigate the incident, and to determine if any personal information was impacted
Retained cybersecurity experts and launched a forensics investigation to determine the source and scope of the compromise
Reported this incident to federal law enforcement and is cooperating with the investigation
Notified the affected individuals
Offered complimentary identity protection services to each individual whose personal information was affected by this event
Reporting this incident to the three credit reporting agencies: Experian, Equifax, and TransUnion
Changes made: Implemented additional security measures to further harden its environment in an effort to prevent a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(248 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGJul 24 · first

Vermont State AGJul 24 · first

Maine State AGJul 24 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/andrews-mcmeel-universal-20230725.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2023
Raw hash: 4ba4a53e504beae40319143ea5cdefa0a5d4284d0a93cdb3de4b866c61e40f23

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityANDREWS MCMEEL UNIVERSAL

Victim entityANDREWS MCMEEL UNIVERSAL

Incidentdiscovered Nov 19, 2022

Stated responseEngaged cybersecurity experts to assist with safely restoring operations, to investigate the incident, and to determine if any personal information was impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov