MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedIdentity (basic)Financial accountFinancial credentialsLowContained

Boomerang Tags

bd_234575a45e7d57fc · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 25, 2014

To disclose

—

Affected

219state residents only

Linked

2 filings

Confidence

67%

Full breach record for Boomerang Tags →

Boomerang Tags notified the NH AG of a security incident where malware installed on its hosting server compromised payment card data (names, addresses, card numbers, CVVs) for approximately 219 NH residents. The compromise occurred between July 4, 2013, and February 18, 2014. The company engaged forensic investigators and replaced its payment processor.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 4, 2013

Begins

Apr 25, 2014

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_4a97e4e34dc645542014-04-30 · +5dCandidate

Name: Boomerang Tags
norm: boomerang tags
Domain: boomerangtags.com

Name: Boomerang Tags
norm: boomerang tags
Domain: boomerangtags.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jul 4, 2013 – Feb 18, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 219state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: external_remote_services

During the incident: Took steps to address and contain the incident the same day it was discovered
Engaged a computer forensic investigator to perform an investigation
Replacing our old payment card processor
Designing an entirely new website with additional security features
Changes made: Replacing our old payment card processor
Designing an entirely new website with additional security features
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 25 · first · this page

California State AG+5d

Pattern: first filing Apr 25 (NH), last Apr 30 (CA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boomerang-tags-20140425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2014
Raw hash: 98638b2ad2df931530f58752c59109ad32c113c74ecda005ed1c372988726704

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBoomerang Tags

Victim entityBoomerang Tags

IncidentThird-Party / Supply Chain

Stated responseTook steps to address and contain the incident the same day it was discovered

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov