HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Financial accountLowContained

Thomas D. Mangelsen, Inc.

bd_2216f7bf752db386 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 25, 2020

Filed

Jan 11, 2021

To disclose

7 weeks

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for Thomas D. Mangelsen, Inc. →

Thomas D. Mangelsen, Inc. (TDMI) notified the New Hampshire Attorney General of a data security event involving its e-commerce website, mangelsen.com. A third-party developer, Forix Commerce, identified malicious code that captured customer payment information (names, addresses, card numbers, CVVs) between Oct 29 and Nov 19, 2020. TDMI discovered the incident on Nov 25, 2020, and began notifying 3 New Hampshire residents on Dec 31, 2020. TDMI secured the site, reset passwords, and provided 12 months of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 7 weeks / 47 days

Oct 29, 2020

Begins

Nov 25, 2020

Discovered

Jan 11, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_038fd847025e710e2020-12-31 · +11dVerified
Indiana State AGbd_23369d37e5d66fb12020-12-31 · +11dVerified
Montana State AGbd_3b924229d39da3322020-12-31 · +11dCandidate
Maine State AGbd_a0a669dc23f7289a2020-12-31 · +11dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Thomas D. Mangelsen, Inc.
norm: thomas d mangelsen
Industry: Retail & Consumerllm

Discovered: Nov 25, 2020
Breach occurred: Oct 29, 2020 – Nov 19, 2020
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 31, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Third party: via Forix Commerce
Initial access: exploit_public_facing

During the incident: Secured its website
Worked with Forix to remove the malicious code
Performed scans for any other malicious code or activities
Performed a global password reset
Provided individuals with twelve (12) months of complimentary access to credit monitoring and identity restoration services through TransUnion
Changes made: Implemented enhanced security controls on its e-commerce website
Changed system passwords
Scheduled additional routine scans for malicious code
Reviewing its existing policies and procedures relating to data protection and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGDec 31 · first

Indiana State AGDec 31 · first

Montana State AGDec 31 · first

Maine State AGDec 31 · first

New Hampshire State AG+11d · this page

Pattern: first filing Dec 31 (MA), last Jan 11 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/thomas-mangelsen-20210111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2021
Raw hash: ff27ba311263d3dd831ab523b0fddc93c4f2f2d6dfb67a3b8da20ddf2d7e9167

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityThomas D. Mangelsen, Inc.

Incidentdiscovered Nov 25, 2020

Stated responseSecured its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov