HackingRetail & ConsumerTechnologyRetailStolen CredentialsVulnerability ExploitData ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

Quayside Publishing Group

bd_2cc9ecd685e0de27 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 21, 2013

To disclose

—

Affected

552scope not determined

Linked

2 filings

Confidence

67%

Full breach record for Quayside Publishing Group →

Quayside Publishing Group notified NH AG of unauthorized access to web servers between April 29 and June 17, 2013. Malicious software accessed credit card numbers, names, and addresses for 552 customers. The company suspended its shopping cart, engaged law enforcement (Minneapolis PD and FBI), and mailed notifications to affected consumers on June 21, 2013.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 29, 2013

Begins

Jun 21, 2013

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_dbd8a4c1946437e62013-07-02 · +11dCandidate

Name: Quayside Publishing Group
norm: quayside publishing

Name: Quayside Publishing Group
norm: quayside publishing
Industry: Retail & ConsumerllmTechnologyllm

Discovered: —
Breach occurred: Apr 29, 2013 – Jun 17, 2013
Materiality determined: —
Notification sent: Jun 21, 2013
Affected individuals: 552scope not determined
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed a police report with the Minneapolis Police (Case 13-193406)Notified the FBI in Minneapolis
Initial access: exploit_public_facing

During the incident: Took immediate steps to contain the breach and initiated an investigation
Shopping cart temporarily suspended
Initiated additional security features
Filed a police report with the Minneapolis Police (Case 13-193406)
Notified the FBI in Minneapolis
Sent a letter via US Mail to each of the consumers who did business with us during this time period to notify them of the breach in our security
Changes made: Ensured all malware has been removed from our server
Initiated additional security features
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 21 · first · this page

California State AG+11d

Pattern: first filing Jun 21 (NH), last Jul 2 (CA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/quayside-publishing-20130621.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 21, 2013
Raw hash: 11d5973a4d824f148a25c05859a7d924196c8fa6df1b46d9ee571837d6e05899

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityQuayside Publishing Group

Victim entityQuayside Publishing Group

IncidentMisconfiguration

Stated responseTook immediate steps to contain the breach and initiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov