HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIFinancial accountLowContained

Zephyr Ventilation

bd_24115f5ddff4f42f · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2023

Filed

Jan 17, 2024

To disclose

24 weeks

Affected

8state residents only

Linked

4 filings

Confidence

66%

Full breach record for Zephyr Ventilation →

Zephyr Ventilation, a subsidiary of Broan-NuTone, notified 8 New Hampshire residents of a data breach involving a malicious script on its website. The script, active from July 20 to August 10, 2023, targeted consumer personal and financial information. Zephyr removed the script, engaged its hosting provider, and offered credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 24 weeks / 169 days

Jul 20, 2023

Begins

Aug 1, 2023

Discovered

Jan 17, 2024

Filed

vs. sector median

+15 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_0cd9c5a5220f6c372024-01-17Candidate
Maine State AGbd_f5192ba0bba5bfcd2024-01-17Verified
Massachusetts State AGbd_129da188c7183f8e2024-01-22 · +5dVerified

Name: Broan-NuTone LLC
norm: broan nutone

Name: Zephyr Ventilation
norm: zephyr ventilation
Industry: Retail & Consumerllm

Discovered: Aug 1, 2023
Breach occurred: Jul 20, 2023 – Aug 10, 2023
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 17, 2024
Affected individuals: 8state-resident count only
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Offering credit monitoring and identity restorations services through Experian
Alerting potentially impacted site users
Removed malicious script from the system
Changes made: Reviewed existing policies and procedures
Implemented additional administrative and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJan 17 · first

Maine State AGJan 17 · first

New Hampshire State AGJan 17 · first · this page

Massachusetts State AG+5d

Pattern: first filing Jan 17 (MT), last Jan 22 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/broan-nutone-zephyr-ventilation-20240117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2024
Raw hash: 7596ea7d6bc34058e139945ff6a8496ba74c26236be3d64b254576256c4000fc

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBroan-NuTone LLC

Victim entityZephyr Ventilation

Incidentdiscovered Aug 1, 2023

Stated responseOffering credit monitoring and identity restorations services through Experian

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov