HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Tupperware U.S., Inc.

bd_3fc83f4951f4dde5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2020

Filed

Apr 22, 2020

To disclose

29 days

Affected

16state residents only

Linked

3 filings

Confidence

66%

Full breach record for Tupperware U.S., Inc. →

Tupperware U.S., Inc. notified the NH Attorney General of a security incident where unauthorized code was inserted into its e-commerce websites (Tupperware.com and Tupperware.ca) between March 19 and March 24, 2020. The code captured customer checkout data including names, addresses, and payment card details. 16 New Hampshire residents were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 29 days

Mar 19, 2020

Begins

Mar 24, 2020

Discovered

Apr 22, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_7bc73ccdec70f67d2020-04-21 · +1dVerified
Indiana State AGbd_8b2096e2403e194a2020-04-21 · +1dVerified

Name: Tupperware U.S., Inc.
norm: tupperware us

Name: Tupperware U.S., Inc.
norm: tupperware us
Industry: Retail & Consumerllm

Discovered: Mar 24, 2020
Breach occurred: Mar 19, 2020 – Mar 24, 2020
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2020
Affected individuals: 16state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code from the websites
Launched an investigation
A cybersecurity firm was engaged to assist
Notified law enforcement
Notified the payment card networks
Changes made: Implemented enhanced technical, administrative, and procedural safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 21 · first

Indiana State AGApr 21 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tupperware-us-20200422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2020
Raw hash: 78e034ae11a0ee9e64197efb8cbd3c6f405a65e3abfdd14b7cfa240a175a940f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTupperware U.S., Inc.

Victim entityTupperware U.S., Inc.

Incidentdiscovered Mar 24, 2020

Stated responseRemoved the unauthorized code from the websites

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov