HackingRetail & ConsumerRetailStolen CredentialsTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Graf & Sons, Inc.

bd_2f51520e9b7138d5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 29, 2019

Filed

Feb 6, 2019

To disclose

8 days

Affected

8state residents only

Linked

2 filings

Confidence

66%

Full breach record for Graf & Sons, Inc. →

Graf & Sons Inc. notified the NH Attorney General of a data event affecting 8 NH residents. A malicious code attack on its e-commerce website captured customer names, addresses, and full credit card details (number, expiry, CVV). The attack was detected on Jan 29, 2019, and confirmed by the service provider on Jan 30, 2019. The malicious code was removed and additional security measures implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 30, 2019

Begins

Feb 6, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_94017a21ae00933b2019-02-06Candidate

Name: Graf & Sons, Inc.
norm: graf sons
Domain: graf.com

Name: Graf & Sons, Inc.
norm: graf sons
Domain: graf.com
Industry: Retail & Consumerllm

Discovered: Jan 29, 2019
Breach occurred: Jan 30, 2019
Materiality determined: —
Notification sent: Feb 6, 2019
Affected individuals: 8state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Federal Bureau of InvestigationNotified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged service provider to investigate the problem
Notified the Federal Bureau of Investigation
Notified the New Hampshire Attorney General
Removed malicious code from the website
Provided guidance to impacted individuals on protecting against identity theft and fraud
Provided information on placing fraud alerts and security freezes on credit files
Changes made: Implemented additional security measures to further secure the website
Implemented additional security measures to secure Graf's information technology environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGFeb 6 · first

New Hampshire State AGFeb 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/graf-sons-20190206.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2019
Raw hash: 1af842cb3149b97b9a10dae0989d04e315cce2db27cf0948009b1948cd56f93e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGraf & Sons, Inc.

Victim entityGraf & Sons, Inc.

Incidentdiscovered Jan 29, 2019

Stated responseEngaged service provider to investigate the problem

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov