HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

CM Group Holdings

bd_2e1f60efbe14fb64 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 19, 2019

Filed

Apr 5, 2019

To disclose

6 weeks

Affected

9state residents only

Linked

3 filings

Confidence

66%

Full breach record for CM Group Holdings →

CM Group Holdings d/b/a Creative Memories notified NH AG of unauthorized access to customer payment data and employee SSNs. Suspicious activity detected Feb 19, 2019. Access occurred Jan 31–Feb 19, 2019. Affected data: names, card numbers, CVVs, SSNs. 9 NH residents notified. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 19 days

discovery → filing · 6 weeks / 45 days

Jan 31, 2019

Begins

Feb 19, 2019

Discovered

Apr 5, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_dd00f5eadc7679ae2019-04-01 · +4dVerified
Montana State AGbd_f82cec5d6e62f7522019-04-01 · +4dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: CM Group Holdings
norm: cm group
Also named: CM Group Holdings, Inc.dba oflegal entity
Creative Memoriesdba oftrade name
Industry: Retail & Consumerllm

Discovered: Feb 19, 2019
Breach occurred: Jan 31, 2019 – Feb 19, 2019
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2019
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the New Hampshire Attorney GeneralProviding written notice of this incident to other state regulators and the consumer reporting agencies
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of a third-party forensic firm
Provided written notice to all potentially affected individuals
Extended an offer of 12 months of complimentary credit monitoring
Working to implement additional safeguards on its site and with its employees
Continues to monitor its e-commerce environment
Providing all impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with potentially impacted Social Security numbers with complimentary credit monitoring services
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Providing individuals with information on protecting against tax fraud
Providing individuals with contact details for the national consumer reporting agencies
Providing individuals with information on how to obtain a free credit report
Encouraging individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank
Reported this incident to the credit card companies
Providing written notice of this incident to other state regulators and the consumer reporting agencies
Changes made: Implementing additional safeguards on its site and with its employees
Continuing to monitor its e-commerce environment to guard against suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 1 · first

Montana State AGApr 1 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cm-group-holdings-20190405.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 5, 2019
Raw hash: 41c650ea7bfd5fb642cbd12d59c654697ee99ec78fa9bcaf983b093a7b4a65da

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCM Group Holdings

Incidentdiscovered Feb 19, 2019

Stated responseLaunched an investigation with the assistance of a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov