HackingRetail & ConsumerRetailSQL InjectionCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Hain Celestial Group, Inc. (Alba Botanica)

bd_3e07a895ac155c73 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 9, 2015

Filed

Jan 28, 2016

To disclose

7 weeks

Affected

4state residents only

Confidence

65%

Full breach record for Hain Celestial Group, Inc. (Alba Botanica) →

Hain Celestial Group (Alba Botanica) notified Montana residents of a data breach affecting the albabotanica.com checkout page. Malicious code inserted between May 16 and Dec 9, 2015, potentially captured payment info (names, addresses, credit card numbers, CVV). No SSNs involved. Kroll provided 1-year identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 207 days

discovery → filing · 7 weeks / 50 days

May 16, 2015

Begins

Dec 9, 2015

Discovered

Jan 28, 2016

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: Hain Celestial Group, Inc. (Alba Botanica)
norm: hain celestial group inc alba botanica

Name: Hain Celestial Group, Inc. (Alba Botanica)
norm: hain celestial group inc alba botanica
Industry: Retail & Consumerllm

Discovered: Dec 9, 2015
Breach occurred: May 16, 2015 – Dec 9, 2015
Undetected for: 207 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Disabled the website to prevent any possible exploitation of the vulnerability
Retained third-party cyber security experts to assist with the investigation
Removed the malicious code and address the vulnerability
Provided notice to individuals, state regulators and consumer reporting agencies
Secured the services of Kroll to provide identity monitoring at no cost for one year
Changes made: Working to enhance the security of the site in preparation of its re-launch
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Hain-Celestial-Group-Inc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2016
Raw hash: 58b10f2ed8eb3ae7a2586774d05a2fc1486a95ae2404edd6e013493e44f81a6f

Reporting entityHain Celestial Group, Inc. (Alba Botanica)

Victim entityHain Celestial Group, Inc. (Alba Botanica)

Incidentdiscovered Dec 9, 2015

Stated responseDisabled the website to prevent any possible exploitation of the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov