HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountAuthenticationLowContained

Thorlo

bd_1a9c273da54c0e74 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 22, 2013

Filed

Feb 7, 2013

To disclose

16 days

Affected

106state residents only

Linked

3 filings

Confidence

66%

Full breach record for Thorlo →2 incidents on file

THORLO, Inc. notified NH AG of a breach affecting 106 NH residents. Unauthorized access to the company website between Nov 14, 2012 and Jan 22, 2013 compromised names, addresses, and credit card data. THORLO took servers offline, engaged forensic auditors, and reported to FBI and local police. Affected individuals offered identity theft safeguards via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 69 days

discovery → filing · 16 days

Nov 14, 2012

Begins

Jan 22, 2013

Discovered

Feb 7, 2013

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_0516eac2bfdb95e82013-02-07Candidate
Massachusetts State AGbd_7ea1c84e5ec12b132013-02-11 · +4dVerified

Name: Katten Muchin Rosenman LLP
norm: katten muchin rosenman

Name: Thorlo
norm: thorlo
Domain: thorlo.com
Industry: Retail & Consumerllm

Discovered: Jan 22, 2013
Breach occurred: Nov 14, 2012 – Jan 22, 2013
Undetected for: 69 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 106state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralReported to FBI Cybersecurity Team
Initial access: exploit_public_facing

During the incident: Took its secure server offline
Reported the breach to its credit card processor
Reported this crime to the Statesville, North Carolina Police Department and the FBI Cybersecurity Team
Hired a recommended forensic auditing firm to conduct an audit of our computer and security systems and protocols
Changes made: Secured the services of Kroll Information Assurance to provide identity theft safeguards at no cost to you
Take additional steps to secure our website in consultation with nationally-recognized experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGFeb 7 · first

New Hampshire State AGFeb 7 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/thorlo-20130207.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 7, 2013
Raw hash: 2dc7d6be67c1b8c6d48a75fd24acd619dd917ee94645c5731767024a260484b0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKatten Muchin Rosenman LLP

Victim entityThorlo

Incidentdiscovered Jan 22, 2013

Stated responseTook its secure server offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov