MalwareRetail & ConsumerRetailRansomwareData EncryptedSupply Chain (3P Vendor)TargetedIdentity (basic)Financial accountFinancial credentialsLowContained

shopPOPdisplays

bd_26063d864be221af · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 11, 2018

To disclose

—

Affected

11state residents only

Linked

3 filings

Confidence

66%

Full breach record for shopPOPdisplays →

shopPOPdisplays, Inc. notified the NH Attorney General of a data breach involving its third-party hosting provider, Miva Inc. Malware was inserted on Miva's servers between April 8 and May 14, 2018, potentially exposing customer credit card data, CVVs, and PII. 11 NH residents may be affected. shopPOPdisplays engaged forensic investigators, reset passwords, and is offering one year of ID theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 8, 2018

Begins

Jun 11, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_675ece26c8d2df702018-06-11Candidate
Massachusetts State AGbd_d7afd99847e692492018-06-14 · +3dVerified

Name: shopPOPdisplays
norm: shoppopdisplays

Name: shopPOPdisplays
norm: shoppopdisplays
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Apr 8, 2018 – May 14, 2018
Materiality determined: —
Notification sent: Jun 11, 2018
Affected individuals: 11state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Miva Inc.
Initial access: supply_chain

During the incident: Miva has removed the malware from the servers supporting our systems
We engaged a forensics firm to determine the source of the intruder's access
We have notified PayPal, Visa, Mastercard, American Express, Discover, and consumer reporting agencies of this incident
We are reviewing all policies and procedures to ensure all necessary and appropriate security measures are taken
Required all users affected by the data incident to reset their passwords associated with their shopPOPdisplays accounts
Working with law enforcement to ensure that this situation is properly addressed
Changes made: Reviewing all policies and procedures to ensure all necessary and appropriate security measures are taken to avoid any similar incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJun 11 · first

New Hampshire State AGJun 11 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shoppopdisplays-20180611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2018
Raw hash: afc6debcc002858f3442bc29dad972f818f5b360c6411718f09392562e9b9bc4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityshopPOPdisplays

Victim entityshopPOPdisplays

IncidentThird-Party / Supply Chain

Stated responseMiva has removed the malware from the servers supporting our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov