HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountAuthenticationLowContained

HRM Enterprises, Inc.

bd_3a4d93abf89c8811 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 8, 2023

Filed

Jul 26, 2023

To disclose

7 weeks

Affected

389state residents only

Linked

7 filings

Confidence

64%

Full breach record for HRM Enterprises, Inc. →

HRM Enterprises, Inc. notified customers that its e-commerce provider, CommerceV3, experienced a data breach. Unauthorized access occurred between Nov 24, 2021, and Dec 14, 2022. Payment card info, names, emails, and billing addresses were potentially accessed. Notification sent July 26, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 561 days

discovery → filing · 7 weeks / 48 days

Nov 24, 2021

Begins

Jun 8, 2023

Discovered

Jul 26, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_08ea0397a9df91962023-07-26Candidate
California State AGbd_94fb78a9de5c5ab72023-07-26Verified
Vermont State AGbd_a134805f0dacc9b62023-07-26Verified
Maine State AGbd_a81a49dc0137c4af2023-07-26Verified

Show 2 more filings ↓

Oregon State AGbd_eb539a02510cc87b2023-07-26Verified by operator
Indiana State AGbd_f7715c0d560006ea2023-07-26Verified by operator

Name: HRM Enterprises, Inc.
norm: hrm enterprises

Name: HRM Enterprises, Inc.
norm: hrm enterprises
Industry: Retail & Consumerllm

Discovered: Jun 8, 2023
Breach occurred: Nov 24, 2021 – Dec 14, 2022
Undetected for: 561 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2023
Affected individuals: 389state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via CommerceV3
Initial access: valid_credentials

During the incident: Moved quickly to investigate upon being notified by CommerceV3
Working with CommerceV3 to obtain additional information about the event
Reviewing processes and policies and making changes as necessary
Updating vendor technical requirements
Reassessing relationships
Changes made: Updating vendor technical requirements
Reassessing relationships
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGJul 26 · first

California State AGJul 26 · first

Vermont State AGJul 26 · first

Maine State AGJul 26 · first

Oregon State AGJul 26 · first

Indiana State AGJul 26 · first

Montana State AGJul 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-472.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2023
Raw hash: 1ea7019412d2eb12eb44f5c4a4b24a90a3f9648e10b36cd53012a050b29adbd6

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityHRM Enterprises, Inc.

Victim entityHRM Enterprises, Inc.

Incidentdiscovered Jun 8, 2023

Stated responseMoved quickly to investigate upon being notified by CommerceV3

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov