HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Duluth Pack

bd_3a4ec79ffe2d632a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 24, 2014

To disclose

—

Affected

1state residents only

Confidence

68%

Full breach record for Duluth Pack →

Duluth Pack notified the NH Attorney General of a security breach affecting one NH resident. Malicious software on the website exposed names, addresses, payment account numbers, and emails. Malware was removed Sept 29, 2014.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Oct 24, 2014

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Duluth Pack
norm: duluth pack
Domain: duluthpack.com

Name: Duluth Pack
norm: duluth pack
Domain: duluthpack.com
Industry: Retail & Consumerllm

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: The malicious software has been removed as of September 29, 2014 from our website
Implemented security measures to ensure the confidentiality of the personal information of those we serve
Changes made: Implemented security measures to ensure the confidentiality of the personal information of those we serve
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/duluth-pack-20141024.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2014
Raw hash: 34f4a8ec17876201b077065b483fcb04ad464c64cff4596fe96d9dac388f6502

Reporting entityDuluth Pack

Victim entityDuluth Pack

IncidentMisconfiguration

Stated responseThe malicious software has been removed as of September 29, 2014 from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov