HackingRetail & ConsumerRetailSQL InjectionStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

One Love Organics, Inc.

bd_2bf8b22a2d20d289 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 15, 2014

Filed

Nov 3, 2014

To disclose

19 days

Affected · nationwide

4874 in this filing

Linked

2 filings

Confidence

66%

Full breach record for One Love Organics, Inc. →

One Love Organics, Inc. notified the NH AG of a breach where an attacker exploited an SQL injection vulnerability in its OpenCart shopping cart system between Aug 24 and Oct 15, 2014. The attacker accessed customer PII and credit card data (including CVVs) for 487 customers. The breach was discovered on Oct 15, 2014, and notifications were sent on Oct 30, 2014.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 52 days

discovery → filing · 19 days

Aug 24, 2014

Begins

Oct 15, 2014

Discovered

Nov 3, 2014

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_2b9a250dbce52b6c2014-11-07 · +4dVerified

Name: One Love Organics, Inc.
norm: one love organics
Domain: oneloveorganics.com

Name: One Love Organics, Inc.
norm: one love organics
Domain: oneloveorganics.com
Industry: Retail & Consumerllm

Discovered: Oct 15, 2014
Breach occurred: Aug 24, 2014 – Oct 15, 2014
Undetected for: 52 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2014
Affected individuals: 487state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Changed all administrator passwords
Deactivated the malicious code added to the credit card authorization transmission scripts
Changed file write access to the most restrictive level, disabling convenience features in the administration interface to prevent future script editing via the web server’s permission level
Removed SQL injection vector in the category listing page of the OpenCart shop system
Started daily automated security log monitoring and weekly manual audits to prevent further incursions from the same party or other parties using similar methods
Reporting this incident to law enforcement
Changes made: Decided to replace our existing shopping cart system with a new one and have already engaged a web developer and will be working diligently to make that transition
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGNov 3 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/one-love-organics-20141103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2014
Raw hash: ccf9fb027717b91c3dbad6febdb17bcd3992f9b460d90ad6d79b4b9cdf35e456

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityOne Love Organics, Inc.

Victim entityOne Love Organics, Inc.

Incidentdiscovered Oct 15, 2014

Stated responseChanged all administrator passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov