HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedFinancial accountIdentity (basic)LowContained

Tech Rabbit

bd_18ecbffd2c2ee58b · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 8, 2018

Filed

Sep 20, 2018

To disclose

6 weeks

Affected

239state residents only

Linked

5 filings

Confidence

66%

Full breach record for Tech Rabbit →

Tech Rabbit, LLC notified the NH Attorney General of a security incident affecting 239 NH residents. Unauthorized access occurred between Feb 22, 2017 and May 22, 2018, confirmed on Aug 8, 2018. Customer payment info (credit card numbers, security codes, names, addresses, emails, phones) was compromised via malware. Notifications mailed Sept 21, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 532 days

discovery → filing · 6 weeks / 43 days

Feb 22, 2017

Begins

Aug 8, 2018

Discovered

Sep 20, 2018

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_89bfe18d4a2a6d202018-09-21 · +1dVerified
Massachusetts State AGbd_0c7e19bc0f271b822018-09-19 · +1dVerified
California State AGbd_12fa3db6a17abb9d2018-09-19 · +1dCandidate
Oregon State AGbd_4939b3922d519b6e2018-09-19 · +1dVerified

Name: Tech Rabbit
norm: tech rabbit
Domain: techrabbit.com

Name: Tech Rabbit
norm: tech rabbit
Domain: techrabbit.com
Industry: Retail & Consumerllm

Discovered: Aug 8, 2018
Breach occurred: Feb 22, 2017 – May 22, 2018
Undetected for: 532 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 21, 2018
Affected individuals: 239state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Provided notice of this incident to state authorities
Initial access: exploit_public_facing

During the incident: Engaged external forensics investigation
Secured the information in its systems
Addressed the root cause of this incident
Improved its information security practices
Alerted its credit card processing company and the credit card brands in accordance with Payment Card Industry Data Security Standards (PCI-DSS)
Provided written notification to affected individuals
Provided a toll-free number for affected individuals
Changes made: Implemented improvements to prevent such unauthorized access from happening again
Continued to implement the recommendations from the security firm
Continued to review and audit practices to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 19 · first

California State AGSep 19 · first

Oregon State AGSep 19 · first

New Hampshire State AG+1d · this page

Montana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tech-rabbit-20180920.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2018
Raw hash: 6080f0a92cf48af6dc65cba37cf2499db43f25a2827af6f3ca1679ebc64a0192

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTech Rabbit

Victim entityTech Rabbit

Incidentdiscovered Aug 8, 2018

Stated responseEngaged external forensics investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov