HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowActive

Nordace Limited

bd_28e0f53e1bbad349 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 17, 2026

Filed

Oct 21, 2026

To disclose

5 weeks

Affected

13state residents only

Linked

3 filings

Confidence

68%

Full breach record for Nordace Limited →

Nordace Limited, an online retailer of travel bags, identified unauthorized code (a skimming script) on its website checkout page on September 17, 2026. The code was inserted between August 2 and August 4, 2026, and was capable of capturing payment card details, names, and addresses. Nordace has not confirmed if data was actually exfiltrated. Approximately 13 New Hampshire residents were potentially affected. Nordace removed the code, reset credentials, implemented MFA, and notified law enforcement and regulators. The investigation into the initial access vector is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 5 weeks / 34 days

Aug 2, 2026

Begins

Sep 17, 2026

Discovered

Oct 21, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_e1deff704f46bf4e2026-10-22 · +1dVerified
Massachusetts State AGbd_dc99c6b699e47c922026-10-01 · +20dVerified

Name: Nordace Limited
norm: nordace
Domain: nordace.com
Industry: Online retailer of travel bags and accessories

Name: Nordace Limited
norm: nordace
Domain: nordace.com
Industry: Online retailer of travel bags and accessories
Industry: Retail & Consumerllm

Discovered: Sep 17, 2026
Breach occurred: Aug 2, 2026 – Sep 17, 2026
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2026
Affected individuals: 13state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: External
Regulator citations: Reported the incident to the Hong Kong Police ForceNotified data protection authorities in other jurisdictionsNotifying the Attorneys General and other state agencies of the other U.S. states

During the incident: Removed the unauthorized script on September 17, 2026
Removed or quarantined other unauthorized changes to its website environment
Changed all administrative credentials and revoked active sessions
Strengthened the access controls for its website administration (including multi-factor authentication for website-administration accounts)
Applied additional controls at the network edge
Completed post-containment security sweeps between September 18 and 27, 2026
Notified its payment processor
Reported the incident to the Hong Kong Police Force on September 24, 2026
Notified data protection authorities in other jurisdictions
Notifying the Attorneys General and other state agencies of the other U.S. states whose statutes require notice
Changes made: Strengthened access controls for website administration including multi-factor authentication
Adding monitoring of the scripts that run on the checkout page
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 1 · first

New Hampshire State AG+20d · this page

Vermont State AG+21d

Pattern: first filing Oct 1 (MA), last Oct 22 (VT) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nordace-limited-20261021.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2026
Raw hash: 70e54cab408b02e919a724725f5ddc5eef10f1ed7e4630aa772aa53c5d88be98

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNordace Limited

Victim entityNordace Limited

Incidentdiscovered Sep 17, 2026

Stated responseRemoved the unauthorized script on September 17, 2026

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov