MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Financial accountFinancial credentialsMediumContained

Plow and Hearth, LLC

bd_19150b43ddb22ef8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2016

Filed

Apr 11, 2017

To disclose

23 weeks

Affected

1,834state residents only

Linked

4 filings

Confidence

66%

Full breach record for Plow and Hearth, LLC →3 incidents on file

Plow and Hearth, LLC filed a supplemental notice with the Hawaii Office of Consumer Protection regarding a malware intrusion at third-party vendor Aptos, Inc. The intrusion, occurring between Feb-Dec 2016, exposed customer names, addresses, phone numbers, and payment card data. 1,834 Hawaii residents were notified between Feb 27 and Mar 14, 2017. Aptos engaged cybersecurity firms and law enforcement.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due23 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 274 days

discovery → filing · 23 weeks / 161 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Apr 11, 2017

Filed

vs. sector median

+16 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_6d744984c173a3392017-03-14 · +28dVerified
Oregon State AGbd_8d419f66b199915f2017-03-10 · +32dVerified
Washington State AGbd_6e0712cdfba6e0502017-02-25 · +45dCandidate

Name: Plow and Hearth, LLC
norm: plow and hearth
Domain: plowandhearth.com
Industry: Retail

Name: Plow and Hearth, LLC
norm: plow and hearth
Domain: plowandhearth.com
Industry: Retail
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 27, 2017
Affected individuals: 1,834state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Aptos promptly reported this matter to the FBI and the U.S. Department of Justice
Initial access: external_remote_services

During the incident: Aptos is working with a leading cybersecurity firm
Aptos has taken steps to secure systems
Aptos is working with law enforcement authorities
The credit card companies and issuing banks are being contacted
Changes made: Remove the malware from its systems
Make security updates to the systems
Strengthening access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGFeb 25 · first

Oregon State AG+13d

Montana State AG+17d

Hawaii State AG+45d · this page

Pattern: first filing Feb 25 (WA), last Apr 11 (HI) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://web.archive.org/web/20211024101019id_/https://cca.hawaii.gov/ocp/files/2016/05/Plow-Hearth-OCP-2017-0181.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2017
Raw hash: 0c694b812e69f134e111b68e52260837de61f84da3a7a73f56a04b1f9a4c2de9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPlow and Hearth, LLC

Victim entityPlow and Hearth, LLC

Incidentdiscovered Nov 1, 2016

Stated responseAptos is working with a leading cybersecurity firm

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenanceweb.archive.org