HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Park'N Fly

bd_3681c38344a2cf44 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2014

Filed

Mar 20, 2015

To disclose

29 weeks

Affected

77state residents only

Linked

6 filings

Confidence

66%

Full breach record for Park'N Fly →2 incidents on file

Park ‘N Fly notified the NH AG of a supplemental data security event. Unauthorized access to its ecommerce site occurred between Nov 27, 2013 and Dec 24, 2014. Data at risk includes names, card numbers, billing addresses, expiration dates, CVVs, emails, passwords, and phone numbers. 77 NH residents identified. Incident contained; forensic investigation completed March 3, 2015.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 278 days

discovery → filing · 29 weeks / 200 days

Nov 27, 2013

Begins

Sep 1, 2014

Discovered

Mar 20, 2015

Filed

vs. sector median

+19 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_1b081412af8a20872015-01-20 · +59dVerified
South Carolina State AGbd_408c80d823e386892015-01-20 · +59dVerified
New Hampshire State AGbd_7144a72e29ab04752015-01-20 · +59dVerified
California State AGbd_2cb24641f81286312015-01-13 · +66dCandidate

Show 1 more filing ↓up to 80d gap

New Hampshire State AGbd_02bdd2aa4b18807d2014-12-30 · +80dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Park'N Fly
norm: park n fly
Domain: parknfly.ca
Industry: Retail & Consumerllm

Discovered: Sep 1, 2014
Breach occurred: Nov 27, 2013 – Dec 24, 2014
Undetected for: 278 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2015
Affected individuals: 77state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged independent third-party forensic experts
Removed payment processes from the ecommerce site
Removed all malicious files identified in the investigation
Blocked all malicious IP addresses in the firewall and server
Implemented PayPal as a new payment processor for website transactions
Enhanced security setting relating to the ecommerce site such as implementing web application firewall, file integrity monitoring, and upgrading the frameworks and PHP components
Reviewed and enhanced policies and procedures regarding data protection including firewall rules
Provided access to identity monitoring and identity protection services for the next 12 months
Established an informational webpage for customers
Addressed questions and concerns from PNF customers through a confidential, toll-free hotline
Changes made: Implemented web application firewall
Implemented file integrity monitoring
Upgraded frameworks and PHP components relating to the ecommerce site
Reviewed and enhanced policies and procedures regarding data protection including firewall rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

New Hampshire State AGDec 30 · first

California State AG+14d

Massachusetts State AG+21d

South Carolina State AG+21d

New Hampshire State AG+21d

New Hampshire State AG+80d · this page

Pattern: first filing Dec 30 (NH), last Mar 20 (NH) — a 80-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/park-n-fly-20150320.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2015
Raw hash: f797119b54a452f88fcf2cabd8e92c042f85d894051d76abcafda31539194726

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityPark'N Fly

Incidentdiscovered Sep 1, 2014

Stated responseEngaged independent third-party forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov