HackingRetail & ConsumerRetailVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

Shumsky Promotional Agency

bd_212832540353a253 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 15, 2013

Filed

May 29, 2013

To disclose

14 days

Affected · nationwide

1,4001 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Shumsky Promotional Agency →

Shumsky Promotional Agency notified the NH AG of a breach involving its e-commerce platform provider. An unauthorized third party accessed ~1,400 cardholder records on May 14, 2013. Data included names, addresses, emails, and credit/debit card numbers with CVVs. Shumsky patched the vulnerability on May 15 and notified consumers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 14 days

May 14, 2013

Begins

May 15, 2013

Discovered

May 29, 2013

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_75bcd326f8215d4c2013-05-29Verified
Massachusetts State AGbd_7aa4ed3a9984b0e42013-05-30 · +1dVerified

Name: Shumsky Promotional Agency
norm: shumsky promotional agency
Domain: shumsky.com

Name: Shumsky Promotional Agency
norm: shumsky promotional agency
Domain: shumsky.com
Industry: Retail & Consumerllm

Discovered: May 15, 2013
Breach occurred: May 14, 2013
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2013
Affected individuals: 1,400state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General, State of New Hampshire
Initial access: exploit_public_facing

During the incident: Service providers identified the breach and immediately implemented security measures
Applied security patches to the relevant systems
Hired experts to review and coordinate additional safeguards
Working with the payment card brands concerning the specific payment cards at issue
Providing direct notification to potentially affected consumers via email and letter
Providing a toll-free telephone number for additional information and assistance
Engaged with technical and legal advisors
Changes made: Applied security patches to the relevant systems
Hired experts to review and coordinate additional safeguards
Put in place updated measures to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGMay 29 · first

New Hampshire State AGMay 29 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shumsky-20130529.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2013
Raw hash: f51390753aac557a04e43e70eb864d6eb77b7b718a110715fcca212ec335f4c5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityShumsky Promotional Agency

Victim entityShumsky Promotional Agency

Incidentdiscovered May 15, 2013

Stated responseService providers identified the breach and immediately implemented security measures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov