HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

DACdb, LLC

bd_23274505c16c741d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 19, 2021

Filed

Feb 16, 2021

To disclose

28 days

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for DACdb, LLC →

DACdb, LLC reported a data breach affecting 2 New Hampshire residents. Malicious code was inserted into a payment card processing page on October 22, 2020, causing credit/debit card data to be exfiltrated to a hacker. The breach was discovered on January 19, 2021, and contained. Affected data included names, addresses, emails, and full payment card details. Notifications were sent on February 9, 2021. Remediation included credential resets, firewall updates, processor page changes, and malware detection software.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 89 days

discovery → filing · 28 days

Oct 22, 2020

Begins

Jan 19, 2021

Discovered

Feb 16, 2021

Filed

vs. sector median

15 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_7a158cb0d20c0ea82021-02-10 · +6dVerified
Oregon State AGbd_faf60265e5e261b42021-02-10 · +6dCandidate

Name: DACdb, LLC
norm: dacdb
Domain: dacdb.com

Name: DACdb, LLC
norm: dacdb
Domain: dacdb.com
Industry: Technologyllm

Discovered: Jan 19, 2021
Breach occurred: Oct 22, 2020
Undetected for: 89 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 9, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a forensic IT firm to investigate the incident
Disabled the malicious code immediately
Engaged a third party forensic IT firm to conduct a comprehensive security review of all of our systems
Changes made: All DACdb users are now required to update their user credentials
New and improved firewalls have been deployed on our servers
User payment card information for this processor is now entered directly on a page hosted by the processor
System-wide malware detection software has been installed
Purchased monthly scanning services as a backstop
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 10 · first

Oregon State AGFeb 10 · first

New Hampshire State AG+6d · this page

Pattern: first filing Feb 10 (MA), last Feb 16 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dacdb-20210216.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2021
Raw hash: 51c9da499f656977c068dd8371f885c17466ed891f08c22576f765c39c7a723b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDACdb, LLC

Victim entityDACdb, LLC

Incidentdiscovered Jan 19, 2021

Stated responseEngaged a forensic IT firm to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov