HackingOtherStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIFinancial accountIdentity (basic)LowContained

The Salvation Army USA

bd_1641c846fb8e8379 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 7, 2017

Filed

Jan 23, 2018

To disclose

11 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for The Salvation Army USA →2 incidents on file

The Salvation Army of Augusta notified the NH AG of a cyber incident where its Auto Auction website's admin menu was publicly accessible without authentication on Nov 7, 2017. One NH resident's PII and credit card data were potentially exposed. Kroll was retained for forensics and identity protection. The website was shut down.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 77 days

Nov 7, 2017

Discovered

Jan 23, 2018

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c16b0b31a7bba2752018-01-25 · +2dVerified

Name: The Salvation Army USA
norm: the salvation army usa
Domain: salvationarmyusa.org

Name: The Salvation Army USA
norm: the salvation army usa
Domain: salvationarmyusa.org
Industry: Otherllm

Discovered: Nov 7, 2017
Materiality determined: —
Notification sent: Jan 12, 2018
Affected individuals: 1state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified NH Department of Justice
Initial access: exploit_public_facing

During the incident: Contacted the third-party web hosting and development vendor for its website, and requested that all management access to the website be completely shut down
Retained the services of a leading forensics firm, Kroll, to perform an investigation
Working closely with the credit card brands and/or their agents
Deleted and purged credit card information, including the panel code and CVV, from the website
Website has since been completely shut down
Secured the services of Kroll to provide identity theft protection services at no cost to any potentially affected individual for one (1) year
Changes made: Website has since been completely shut down
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 23 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/salvation-army-20180123.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2018
Raw hash: 11055ff9c392f27408227b8f36f6dc3af96c59dc8e608a9eee78d7e530e21c5f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Salvation Army USA

Victim entityThe Salvation Army USA

Incidentdiscovered Nov 7, 2017

Stated responseContacted the third-party web hosting and development vendor for its website, and requested that all management access to the website be completely shut down

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov