HackingIdentity (basic)Financial accountLowContained

Maplesoft

bd_3639d71c4bfe2d08 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 7, 2022

Filed

Apr 12, 2022

To disclose

5 days

Affected

8state residents only

Linked

4 filings

Confidence

66%

Full breach record for Maplesoft →2 incidents on file

Maplesoft (Waterloo Maple Inc.) notified New Hampshire AG of a data breach affecting 8 NH customers. A malicious script was inserted into the online store on or around July 21, 2021, capturing names, addresses, emails, and credit card details. Discovered April 7, 2022, the script was removed, the site shut down, and passwords reset. Notifications were sent to affected users.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 260 days

discovery → filing · 5 days

Jul 21, 2021

Begins

Apr 7, 2022

Discovered

Apr 12, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_9603f8c69be242e52022-04-12Verified
Indiana State AGbd_478da2dbe65dc6f82022-04-09 · +3dVerified
Montana State AGbd_b5fdcdd472b978052022-04-09 · +3dCandidate

Name: Waterloo Maple Inc.
norm: waterloo maple
Domain: maplesoft.com

Name: Maplesoft
norm: maplesoft
Domain: maplesoft.com

Discovered: Apr 7, 2022
Breach occurred: Jul 21, 2021
Undetected for: 260 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 12, 2022
Affected individuals: 8state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Temporarily shut down our website
Reset all passwords
Conducted a thorough investigation
Removed the malicious script from our online store
Actively monitoring our platforms and systems
Changes made: Developing a plan for increased vigilance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGApr 9 · first

Montana State AGApr 9 · first

Massachusetts State AG+3d

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/maplesoft-20220412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2022
Raw hash: 790e9e940b01429f03ff66ad12577950231aa15182f19428da81c8d59fe8191c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWaterloo Maple Inc.

Victim entityMaplesoft

Incidentdiscovered Apr 7, 2022

Stated responseTemporarily shut down our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov