HackingRetail & ConsumerRetailVulnerability ExploitTargetedData ExfiltratedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

Fabric Depot

bd_2473727e3d3fb79d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 7, 2013

Filed

Mar 4, 2013

To disclose

8 weeks

Affected

245state residents only

Linked

2 filings

Confidence

66%

Full breach record for Fabric Depot →

Fabric Depot, Inc. reported a data breach affecting 245 New Hampshire residents. Unauthorized access occurred on or about October 16, 2012, when an external hacker attacked the company's website. The incident exposed customer names, credit/debit card numbers, verification codes, and billing addresses. Fabric Depot discovered the incident on January 7, 2013, engaged forensic investigators, shut down payment processing, and notified law enforcement and credit card brands. Notifications were sent to affected individuals on March 4, 2013.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 83 days

discovery → filing · 8 weeks / 56 days

Oct 16, 2012

Begins

Jan 7, 2013

Discovered

Mar 4, 2013

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_0a873f2fb3a045362013-03-01 · +3dCandidate

Name: Lane Powell
norm: lane powell
Domain: fabricmc.net

Name: Fabric Depot
norm: fabric depot
Domain: fabricdepot.com
Industry: Retail & Consumerllm

Discovered: Jan 7, 2013
Breach occurred: Oct 16, 2012
Undetected for: 83 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 4, 2013
Affected individuals: 245state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified NH Department of Justice Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Hired a nationally recognized computer forensic investigator
Shut down its online payment processing system
Notified law enforcement
Cooperating with law enforcement investigations
Notified credit card brands
Changes made: Engaging a trusted third party payment processor to collect and handle credit card payment data
Conducting regular reviews of its website and online data systems to detect and address vulnerabilities
Routinely verifying that the website is compliant with Payment Card Industry security standards
Implementing additional technological safeguards to improve the security of Fabric Depot’s data systems and website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGMar 1 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fabric-depot-20130304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2013
Raw hash: c3e525481f21e12b53ee53b9a294e002aba697a6681325489ba25e2cdda68756

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLane Powell

Victim entityFabric Depot

Incidentdiscovered Jan 7, 2013

Stated responseHired a nationally recognized computer forensic investigator

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov