HackingRetail & ConsumerRetailStolen CredentialsPhishingData ExfiltratedCustomer Data InvolvedFinancial accountPIILowContained

Northwest Crop Protection LLC

bd_37261d1c2f9ba73a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 1, 2024

To disclose

—

Affected

21state residents only

Linked

2 filings

Confidence

67%

Full breach record for Northwest Crop Protection LLC →

Northwest Crop Protection LLC notified the NH DOJ of a breach in Q1 2023 where customer credit card and billing info was stolen via a compromised Dropbox account connected to the web host. 21 NH residents affected. Remediation included infrastructure rebuild, MFA, and mEDR.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2023

Begins

Oct 1, 2024

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_67f98e351c408d6b2024-10-07 · +6dVerified

Name: Northwest Crop Protection LLC
norm: northwest crop protection

Name: Northwest Crop Protection LLC
norm: northwest crop protection
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 1, 2023 – Mar 31, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 21state-resident count only
Data types: Financial accountPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified NH Department of Justice
Initial access: supply_chain

During the incident: Rebuilt their webhost and infrastructure from the ground up
Implemented two factor authentication for all server administration actions
Installed Managed Endpoint Detection and Response (mEDR) software on all servers and user computers
Sent notification to affected users via email
Sent physical letters to affected users where email bounced
Changes made: Rebuilt webhost and infrastructure to comply with commercial security practices
Implemented hardened hosting
Implemented two factor authentication for server administration
Deployed Managed Endpoint Detection and Response (mEDR) software
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 1 · first · this page

Maine State AG+6d

Pattern: first filing Oct 1 (NH), last Oct 7 (ME) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northwest-crop-protection-20241001.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2024
Raw hash: 1b1225bdbbc48b4b6c2cc9cb4a641cd1d5c306960bcca75554fcfd81843c01fb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorthwest Crop Protection LLC

Victim entityNorthwest Crop Protection LLC

IncidentThird-Party / Supply Chain

Stated responseRebuilt their webhost and infrastructure from the ground up

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov