HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumActive

Princess Polly Group Pty. Ltd.

bd_243e455eea2d8d5d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2019

Filed

Jun 7, 2019

To disclose

6 weeks

Affected

2,290state residents only

Linked

6 filings

Confidence

70%

Full breach record for Princess Polly Group Pty. Ltd. →

Princess Polly Group Pty Ltd, an Australian clothing retailer, notified the Washington Attorney General on June 7, 2019, of a cybersecurity incident affecting 2,290 Washington residents. Unauthorized access to the company's website occurred between November 1, 2018, and April 29, 2019. The incident involved the potential access of customer names, credit card details, and usernames/passwords. The company engaged external IT and cybersecurity consultants for investigation and implemented additional security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 174 days

discovery → filing · 6 weeks / 44 days

Nov 1, 2018

Begins

Apr 24, 2019

Discovered

Jun 7, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_5ee66b78eece5a852019-06-07Verified
California State AGbd_c7693b5f3079e6a22019-06-07Verified
Montana State AGbd_b0a23f6591c1325f2019-06-06 · +1dVerified by operator
New Hampshire State AGbd_7d21581291709ebe2019-06-03 · +4dVerified

Show 1 more filing ↓up to 8d gap

Oregon State AGbd_1ff09f03b52d883e2019-05-30 · +8dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Princess Polly Group Pty. Ltd.
norm: princess polly
Domain: princesspolly.com
Industry: Retail & Consumerllm

Discovered: Apr 24, 2019
Breach occurred: Nov 1, 2018 – Apr 29, 2019
Undetected for: 174 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 6, 2019
Affected individuals: 2,290state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged external IT and Cyber Security consultants to fully investigate this incident
Additional security measures were taken to further secure the website and customer payment information
Provided written notice of this incident to affected individuals
Provided individuals with guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Encouraged individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement
Changes made: Additional security measures were taken to further secure the website and customer payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGMay 30 · first

New Hampshire State AG+4d

Montana State AG+7d

Massachusetts State AG+8d

California State AG+8d

Washington State AG+8d · this page

Pattern: first filing May 30 (OR), last Jun 7 (WA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10639.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2019
Raw hash: 8f17f21b4520215149345b5a61a9e220f1b9e4063729da8772866678b7d5d76e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityPrincess Polly Group Pty. Ltd.

Incidentdiscovered Apr 24, 2019

Stated responseEngaged external IT and Cyber Security consultants to fully investigate this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com