HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataTargetedCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

National Baseball Hall of Fame and Museum

bd_2dc9598173c9b0c6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 18, 2019

Filed

Feb 2, 2019

To disclose

—

Affected

7state residents only

Confidence

63%

Full breach record for National Baseball Hall of Fame and Museum →2 incidents on file

The National Baseball Hall of Fame and Museum notified customers that malicious code placed on its web store between Nov 15, 2018 and May 14, 2019 may have captured names, addresses, and credit/debit card details including CVVs. The Hall retained forensic investigators, removed the code, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 215 days

discovery → filing · ≤1 day / 0 days

Nov 15, 2018

Begins

Jun 18, 2019

Discovered

Feb 2, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident

Name: National Baseball Hall of Fame and Museum
norm: national baseball hall of fame and museum
Domain: baseballhall.org

Name: National Baseball Hall of Fame and Museum
norm: national baseball hall of fame and museum
Domain: baseballhall.org
Industry: Retail & Consumerllm

Discovered: Jun 18, 2019
Breach occurred: Nov 15, 2018 – May 14, 2019
Undetected for: 215 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 7state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Retained a forensic security firm to investigate the incident
Notified law enforcement
Removed the malicious code from our web store
Alerted the credit card brands of the incident
Taken additional technical steps to further secure our web store
Changes made: Taken additional technical steps to further secure our web store and prevent this type of incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Data-Breach-NotificationDetails7.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2019
Raw hash: 9675ea93e631b83406b648816fa173f0bd8d6d9d1552b95b3bf875df35ef866d

Reporting entityNational Baseball Hall of Fame and Museum

Victim entityNational Baseball Hall of Fame and Museum

Incidentdiscovered Jun 18, 2019

Stated responseRetained a forensic security firm to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov