HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Park'N Fly

bd_3681c38344a2cf44 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2014

Filed

Mar 20, 2015

To disclose

29 weeks

Affected

77state residents only

Confidence

66%

Full breach record for Park'N Fly →4 incidents on file

Park ‘N Fly notified the NH AG of a supplemental data security event. Unauthorized access to its ecommerce site occurred between Nov 27, 2013 and Dec 24, 2014. Data at risk includes names, card numbers, billing addresses, expiration dates, CVVs, emails, passwords, and phone numbers. 77 NH residents identified. Incident contained; forensic investigation completed March 3, 2015.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 278 days

discovery → filing · 29 weeks / 200 days

Nov 27, 2013

Begins

Sep 1, 2014

Discovered

Mar 20, 2015

Filed

vs. sector median

+21 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed77 affectedView incident

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Park'N Fly
norm: park n fly
Domain: parknfly.ca
Industry: Retail & Consumerllm

Discovered: Sep 1, 2014
Breach occurred: Nov 27, 2013 – Dec 24, 2014
Undetected for: 278 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2015
Affected individuals: 77state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged independent third-party forensic experts
Removed payment processes from the ecommerce site
Removed all malicious files identified in the investigation
Blocked all malicious IP addresses in the firewall and server
Implemented PayPal as a new payment processor for website transactions
Enhanced security setting relating to the ecommerce site such as implementing web application firewall, file integrity monitoring, and upgrading the frameworks and PHP components
Reviewed and enhanced policies and procedures regarding data protection including firewall rules
Provided access to identity monitoring and identity protection services for the next 12 months
Established an informational webpage for customers
Addressed questions and concerns from PNF customers through a confidential, toll-free hotline
Changes made: Implemented web application firewall
Implemented file integrity monitoring
Upgraded frameworks and PHP components relating to the ecommerce site
Reviewed and enhanced policies and procedures regarding data protection including firewall rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/park-n-fly-20150320.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2015
Raw hash: f797119b54a452f88fcf2cabd8e92c042f85d894051d76abcafda31539194726

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityPark'N Fly

Incidentdiscovered Sep 1, 2014

Stated responseEngaged independent third-party forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov