PhysicalRetail & ConsumerRetailTheftDelayed DiscoveryIdentity (basic)Government IDEmploymentHighContained

Bill Dube Inc.

bd_2aca8d14d78dfd8d · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 5, 2008

Filed

Dec 5, 2008

To disclose

17 weeks

Affected · nationwide

35,0007,375 in this filing

Confidence

64%

Full breach record for Bill Dube Inc. →

Bill Dube Inc. and Dube Auto Group Inc. reported a security breach involving a missing backup computer tape containing customer and employee PII (names, SSNs, driver's licenses). The tape was found missing on August 5, 2008. Notification was delayed pending law enforcement review. Approximately 7,375 NH residents and up to 35,000 individuals nationwide were affected. Notices were sent in December 2008.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 17 weeks / 122 days

Aug 4, 2008

Begins

Aug 5, 2008

Discovered

Dec 5, 2008

Filed

vs. sector median

+10 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed35,000 affectedView incident

Name: MCCARTER & ENGLISH, LLP
norm: mccarter english

Name: Bill Dube Inc.
norm: bill dube
Industry: Retail & Consumerllm

Discovered: Aug 5, 2008
Breach occurred: Aug 4, 2008
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 5, 2008
Affected individuals: 35,000state + nationwide
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Department of Justice Consumer Protection BureauNotified Massachusetts Attorney GeneralCooperated with Dover Police Department investigation

During the incident: Reported the incident to law enforcement authorities
Opened a dedicated telephone line to answer questions
Retained a professional service to process the information on the back up tape
Conducted mailings using National Change of Address Service (NCOA)
Reviewed practices in the area of data security
Changes made: Reviewing practices in the area of data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(122 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bill-dube-20090108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2008
Raw hash: d468c4f7053b9584840eb40c11e15a774ae2f742d8215ee2efcccb653d9a3813

Reporting entityMCCARTER & ENGLISH, LLP

Victim entityBill Dube Inc.

Incidentdiscovered Aug 5, 2008

Stated responseReported the incident to law enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov