HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

North 40 Outfitters

bd_413daf193a69e164 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2018

Filed

Apr 29, 2019

To disclose

25 weeks

Affected

11state residents only

Linked

7 filings

Confidence

66%

Full breach record for North 40 Outfitters →3 incidents on file

Supplemental notice to NH AG regarding North 40 Outfitters data breach. Intruder introduced malicious script on webserver capturing card data (Dec 17, 2018 - Jan 22, 2019). 11 NH residents affected. Incident discovered Nov 8, 2018. Access blocked. PFI investigation concluded March 26, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 17, 2018

Begins

Apr 29, 2019

Filed

vs. sector median

+17 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_c382d77b4fab019c2019-02-19 · +69dVerified
Montana State AGbd_4b668a3582761b702019-02-14 · +74dCandidate
Washington State AGbd_91ec3d5509abff2e2019-02-14 · +74dVerified by operator
Oregon State AGbd_9f6005ba312469512019-02-14 · +74dVerified

Show 2 more filings ↓up to 74d gap

Massachusetts State AGbd_b52d773a93fb37ee2019-02-14 · +74dVerified
California State AGbd_e64ead328d32d9722019-02-14 · +74dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: North 40 Outfitters
norm: north 40 outfitters
Industry: Retail & Consumerllm

Discovered: Nov 8, 2018
Breach occurred: Dec 17, 2018 – Jan 22, 2019
Materiality determined: —
Notification sent: Apr 25, 2019
Affected individuals: 11state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: reported this incident to certain state regulators, Attorneys General and law enforcement
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a third-party forensic firm
Successfully blocked further unauthorized access to customer card information
Provided notice of the incident to the affected individuals and your office on February 14, 2019
Reported this incident to your credit card company
Reporting this incident to certain state regulators, Attorneys General and law enforcement
Changes made: Working to implement additional safeguards and training to further protect the privacy and security of information in our care
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(172 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Montana State AGFeb 14 · first

Washington State AGFeb 14 · first

Oregon State AGFeb 14 · first

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first

New Hampshire State AG+5d

New Hampshire State AG+74d · this page

Pattern: first filing Feb 14 (MT), last Apr 29 (NH) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-forty-20190429.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2019
Raw hash: 7ce01a479659290a33429f021d3c1b6065593cbe0bb8b0dcb740db2f7eb495c9

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityNorth 40 Outfitters

Incidentdiscovered Nov 8, 2018

Stated responseLaunched an investigation with the assistance of a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov