HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataTargetedCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsMediumContained

NLU Products, LLC

bd_3c176fc4951e06fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 8, 2016

Filed

Jul 16, 2016

To disclose

5 weeks

Affected

2,527state residents only

Linked

5 filings

Confidence

69%

Full breach record for NLU Products, LLC →2 incidents on file

NLU Products, LLC notified Washington AG of unauthorized access to internal network starting April 2015, discovered June 8, 2016. Compromised data included names, addresses, and credit card numbers/CCVs for 2,527 WA residents. Notifications sent July 5-6, 2016. Response included law enforcement report, credit bureau notification, and 1-year Kroll credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 434 days

discovery → filing · 5 weeks / 38 days

Apr 1, 2015

Begins

Jun 8, 2016

Discovered

Jul 16, 2016

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_a76fbf9babdbd7c32016-07-25 · +9dVerified
Massachusetts State AGbd_b8534b2d975d139f2016-07-25 · +9dVerified
Oregon State AGbd_b6d5ca48308e3cc42016-07-27 · +11dVerified
South Carolina State AGbd_ba2485c1cf59befd2016-07-28 · +12dVerified

Name: Dorsey & Whitney LLP
norm: dorsey whitney

Name: NLU Products, LLC
norm: nlu products
Industry: Retail & Consumerllm

Discovered: Jun 8, 2016
Breach occurred: Apr 1, 2015
Undetected for: 434 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 5, 2016
Affected individuals: 2,527state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Data elements: Financial account numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General's Office

During the incident: Reported the incident to appropriate law-enforcement authorities
Notified the three major U.S. credit reporting agencies
Offered one year of free credit monitoring services to the affected residents
Retained two top-rated, certified independent investigation teams to separately analyze the intrusion
Changes made: Continue to use the results of their investigations to implement any needed changes
Continue to conduct regular assessments of its system to ensure its security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGJul 16 · first · this page

New Hampshire State AG+9d

Massachusetts State AG+9d

Oregon State AG+11d

South Carolina State AG+12d

Pattern: first filing Jul 16 (WA), last Jul 28 (SC) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9632.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2016
Raw hash: 6cb955be0e1bacf1339999a3a925f989f1d8d2ecddd5527d5124689f241a4771

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDorsey & Whitney LLP

Victim entityNLU Products, LLC

Incidentdiscovered Jun 8, 2016

Stated responseReported the incident to appropriate law-enforcement authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com