HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIFinancial accountLowContained

MT. HOOD MEADOWS OREG., LLC

bd_3168f30fd40a7909 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 9, 2023

Filed

Nov 9, 2023

To disclose

35 weeks

Affected

15state residents only

Linked

6 filings

Confidence

66%

Full breach record for MT. HOOD MEADOWS OREG., LLC →2 incidents on file

Mt. Hood Meadows Oreg LLC notified the NH AG of a cybersecurity incident discovered March 9, 2023. Unauthorized access via web server code modification occurred Feb 21–Mar 14, 2023, potentially compromising credit card info for 15 NH residents. Notifications mailed Oct 27, 2023, including 1-year Kroll monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 35 weeks / 245 days

Feb 21, 2023

Begins

Mar 9, 2023

Discovered

Nov 9, 2023

Filed

vs. sector median

+28 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_0ac1d3fa19ead1ac2023-11-01 · +8dCandidate
Montana State AGbd_0ed387233cbddd3c2023-11-01 · +8dVerified
Massachusetts State AGbd_56857575236fb0d32023-11-01 · +8dVerified
Vermont State AGbd_613ac404b9a9d1fe2023-10-27 · +13dVerified

Show 1 more filing ↓up to 13d gap

Indiana State AGbd_db799a03efa250802023-10-27 · +13dVerified

Name: Wilson Elser Moskowitz Edelman and Dicker LLP
norm: wilson elser Moskowitz Edelman and Dicker

Name: MT. HOOD MEADOWS OREG., LLC
norm: mt hood meadows oreg
Industry: Retail & Consumerllm

Discovered: Mar 9, 2023
Breach occurred: Feb 21, 2023 – Mar 14, 2023
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 27, 2023
Affected individuals: 15state-resident count only
Data types: PIIFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI
Initial access: exploit_public_facing

During the incident: Moved quickly to secure the network environment
Launched a thorough investigation with the help of independent IT security and forensic investigators
Taking down the website until they could ensure it was secure
Mitigated attempts to gain access to guest information
Contacted the FBI to report the potential compromise
Replaced their entire website partnering with Big Commerce
Had a security audit of their network from CFC Response
Secured the services of Kroll to provide identity monitoring at no cost to affected individuals for one year
Changes made: Reviewed and taken steps to enhance their policies and procedures relating to the security of their systems and servers
Enhanced information life cycle management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(245 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGOct 27 · first

Indiana State AGOct 27 · first

Washington State AG+5d

Montana State AG+5d

Massachusetts State AG+5d

New Hampshire State AG+13d · this page

Pattern: first filing Oct 27 (VT), last Nov 9 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mt-hood-meadows-oreg-20231109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2023
Raw hash: 555a1b0a5244e4fabad81389003096c96ddf50880ec8a223a7dbb64887178a7e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman and Dicker LLP

Victim entityMT. HOOD MEADOWS OREG., LLC

Incidentdiscovered Mar 9, 2023

Stated responseMoved quickly to secure the network environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov