HackingRetail & ConsumerTechnologyRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

EnChroma, Inc.

bd_404f2a4abda28a8a · schema v1 · pii pii-v1

Severity

Low

Discovered

May 17, 2018

Filed

Jul 11, 2018

To disclose

8 weeks

Affected

2state residents only

Confidence

66%

Full breach record for EnChroma, Inc. →2 incidents on file

EnChroma, Inc. notified New Hampshire of a data breach occurring May 15-17, 2018. A hacker infiltrated the website, injected malware, and exfiltrated customer PII and payment data (names, addresses, credit card numbers, CVC). 2 NH residents were affected. Notifications were sent June 27, 2018. EnChroma quarantined the system and migrated to a new platform.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 8 weeks / 55 days

May 15, 2018

Begins

May 17, 2018

Discovered

Jul 11, 2018

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: EnChroma, Inc.
norm: enchroma
Domain: enchroma.com

Name: EnChroma, Inc.
norm: enchroma
Domain: enchroma.com
Industry: Retail & ConsumerllmTechnologyllm

Discovered: May 17, 2018
Breach occurred: May 15, 2018 – May 17, 2018
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 27, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Completely shut down and quarantined the computer system that was infiltrated
Migrated our entire website to a completely new, secure third-party platform
Changes made: Migrated our entire website to a completely new, secure third-party platform so that there is no possibility of code contamination
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enchroma-20180711.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2018
Raw hash: 7fd8392b656aad70efde05efa17b8e6d7c0168e91067e4fea1c07102ab06ff37

Reporting entityEnChroma, Inc.

Victim entityEnChroma, Inc.

Incidentdiscovered May 17, 2018

Stated responseCompletely shut down and quarantined the computer system that was infiltrated

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov