HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowContained
Malley's Candies, Inc.
bd_31b664a0bbfdc878 · schema v1 · pii pii-v1
Full breach record for Malley's Candies, Inc. →Malley's Candies, Inc. notified the New Hampshire Attorney General of a cybersecurity incident affecting approximately 38 NH residents. Between April 11, 2021, and March 2, 2022, malicious code on malleys.com captured payment card data (names, card numbers, CVVs, expiration dates). The company discovered the breach on April 7, 2022, engaged forensic investigators, and began notifying affected individuals on May 6, 2022.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_b9237fedfe428478Montana State AGfiled 2022-05-06(12d gap)Candidate
- bd_cc9e4af726dfa747Maine State AGfiled 2022-05-06(12d gap)Verified
- bd_1957d2c396e2e49dNew Hampshire State AGfiled 2022-08-15(89d gap)Verified
- bd_2fad11d4b49e87c9Maine State AGfiled 2022-08-15(89d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/malleys-candies-20220518.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 18, 2022
- Raw hash
- 4146a273cc891c9212b622f356eab08147838eb150a8e2fddef8ae32b3cf8bc6
Reporting entity
- Name
- Malley's Candies, Inc.norm: malley s candies
- Domain
- malleys.com
Victim entity
- Name
- Malley's Candies, Inc.norm: malley s candies
- Domain
- malleys.com
Incident
- Discovered
- Apr 7, 2022
- Materiality determined
- —
- Notification sent
- May 6, 2022
- Affected individuals
- 38
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1056 Input Capture
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(41 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.