HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedFinancial accountPIILowContained

BetterDoor

bd_1fe26712649dd5bd · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 22, 2024

Filed

Dec 31, 2024

To disclose

6 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for BetterDoor →

Betterdoor.com notified customers of a security incident involving its e-commerce platform. Unauthorized code was added to the website after July 30, 2023, potentially capturing payment card information entered during checkout. The code was identified and removed on November 22, 2024. Betterdoor implemented additional security measures and advised customers to monitor payment statements.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 481 days

discovery → filing · 6 weeks / 39 days

Jul 30, 2023

Begins

Nov 22, 2024

Discovered

Dec 31, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_27adaef32e3009832024-12-31Verified
Massachusetts State AGbd_61badf2be3a667d82024-12-31Verified
Montana State AGbd_ae400b6021c091de2024-12-31Verified
Indiana State AGbd_cc8d151de9eddae72024-12-31Verified

Show 2 more filings ↓

Maine State AGbd_f6e2d5faac76063b2024-12-31Candidate
California State AGbd_ff8fd619bd94a9092024-12-31Verified

Name: BetterDoor
norm: betterdoor
Domain: betterdoor.com

Name: BetterDoor
norm: betterdoor
Domain: betterdoor.com
Industry: Retail & Consumerllm

Discovered: Nov 22, 2024
Breach occurred: Jul 30, 2023
Undetected for: 481 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountPII
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Identified and removed unauthorized code from the website
Implemented additional security measures
Changes made: Implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGDec 31 · first

Massachusetts State AGDec 31 · first

Montana State AGDec 31 · first

Indiana State AGDec 31 · first

Maine State AGDec 31 · first

California State AGDec 31 · first

New Hampshire State AGDec 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/betterdoor-20241231.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 31, 2024
Raw hash: 8294848bceecd7536dab7aeb19e9e58716bc78d990af35b3cfff549622fe2375

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBetterDoor

Victim entityBetterDoor

Incidentdiscovered Nov 22, 2024

Stated responseIdentified and removed unauthorized code from the website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov