HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Tommie Copper

bd_3cb23ad07d9a6af4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2018

Filed

Jul 11, 2018

To disclose

6 weeks

Affected

173state residents only

Linked

5 filings

Confidence

66%

Full breach record for Tommie Copper →2 incidents on file

Tommie Copper, Inc. notified the New Hampshire AG of a data security incident affecting 173 NH residents. Malware was inserted into the company's website between Nov 10, 2017 and Jan 22, 2018, collecting customer names, addresses, and payment card details (including CVV). The malware was confirmed on June 1, 2018. Notices were mailed on July 11, 2018. The company engaged forensic investigators and enhanced website security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 203 days

discovery → filing · 6 weeks / 40 days

Nov 10, 2017

Begins

Jun 1, 2018

Discovered

Jul 11, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_19476cf9a1fafba32018-07-11Verified
Montana State AGbd_3efb04bbd29661162018-07-11Candidate
Massachusetts State AGbd_497d1255cd814fbf2018-07-11Verified
Oregon State AGbd_b64fa8601bc5d5362018-07-11Verified by operator

Name: Tommie Copper
norm: tommie copper

Name: Tommie Copper
norm: tommie copper
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Nov 10, 2017 – Jan 22, 2018
Undetected for: 203 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2018
Affected individuals: 173state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralWill provide notice to other state regulators as required
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Retained a third party forensic investigator
Removed the malicious code
Implemented additional security measures
More rigorous review of all changes made to its code base
Further limiting the number of individuals who can access its website administrative console
Whitelisting of IP addresses to the website administrative console
Further strengthening of requirements for system passwords
Reviewing the Magento Administrative User Audit Report daily
Changes made: More rigorous review of all changes made to its code base
Further limiting the number of individuals who can access its website administrative console
Whitelisting of IP addresses to the website administrative console
Further strengthening of requirements for system passwords
Reviewing the Magento Administrative User Audit Report daily
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGJul 11 · first

Montana State AGJul 11 · first

Massachusetts State AGJul 11 · first

Oregon State AGJul 11 · first

New Hampshire State AGJul 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tommie-copper-20180711.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2018
Raw hash: 38a2987d7f25a9d1bbf8ae2988a8410c44f27ba4b6b58ca927a8dedc3e141765

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTommie Copper

Victim entityTommie Copper

Incidentdiscovered Jun 1, 2018

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov