HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

RealTruck, Inc.

bd_260663ed87b3cc0f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2017

Filed

Mar 17, 2017

To disclose

11 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for RealTruck, Inc. →

RealTruck, Inc. notified the New Hampshire Attorney General of a cyber intrusion detected in late January 2017. The incident involved unauthorized access to a web server, potentially affecting one New Hampshire resident's personal information, including SSN, driver's license number, and bank account number. RealTruck mailed notifications on March 10, 2017, and provided 24 months of credit monitoring. The company installed a new firewall and reset passwords.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 22, 2017

Begins

Mar 17, 2017

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_68774645a68b25642017-03-17Verified

Name: RealTruck, Inc.
norm: realtruck

Name: RealTruck, Inc.
norm: realtruck
Industry: Retail & Consumerllm

Discovered: Jan 1, 2017
Breach occurred: Jan 22, 2017
Materiality determined: —
Notification sent: Mar 10, 2017
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an immediate review to determine the scope of the incident
Took immediate steps to notify and provide assistance to the one affected New Hampshire resident
Mailed written notifications to affected individuals
Made available to all affected individuals 24 months of credit monitoring services from AllClear ID, at no cost
Installed a new firewall
Reset passwords
Changes made: Undertaking a review of its systems to help further harden its defenses and guard against a similar incident occurring in the future
Locked down our systems to ensure any access has been cut off
Conducting an internal review of our systems to help further harden its defenses against similar attacks in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 17 · first

New Hampshire State AGMar 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/realtruck-20170317.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2017
Raw hash: 751385bca38921ca969f5919a0fa1f7c8e3584646c66d88a058a1fbd314ec862

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRealTruck, Inc.

Victim entityRealTruck, Inc.

Incidentdiscovered Jan 1, 2017

Stated responseLaunched an immediate review to determine the scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov