HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Atwood Distributing, Inc.

bd_482d332c0a4ce224 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Mar 21, 2017

To disclose

20 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Atwood Distributing, Inc. →

Atwood Distributing, L.P. filed a supplemental data breach notice with the NH Attorney General regarding a third-party platform provider (Aptos, Inc.) intrusion. The breach, occurring Feb-Dec 2016, exposed customer names, addresses, phone numbers, and payment card numbers. 2 NH residents were notified on March 7, 2017. Identity protection services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 274 days

discovery → filing · 20 weeks / 140 days

Feb 1, 2016

Begins

Nov 1, 2016

Discovered

Mar 21, 2017

Filed

vs. sector median

+12 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6e2bc37c0ebcf2552017-03-23 · +2dVerified
Montana State AGbd_534aabb0020c65e82017-03-07 · +14dCandidate

Name: Atwood Distributing, Inc.
norm: atwood distributing
Domain: atwoods.com

Name: Atwood Distributing, Inc.
norm: atwood distributing
Domain: atwoods.com
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Feb 1, 2016 – Dec 1, 2016
Undetected for: 274 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 7, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Aptos reported the matter to the FBI and the U.S. Department of JusticeLaw enforcement requested that Aptos not notify the affected retailers before February 5, 2017
Third party: via Aptos, Inc.
Initial access: external_remote_services

During the incident: Sent notice by first class mail to the affected consumers
Aptos notified Atwoods
Aptos reported the matter to the FBI and the U.S. Department of Justice
Aptos worked with a leading cybersecurity firm to remove the malware from its systems
Aptos made security updates to the systems, including strengthening access controls
Changes made: Aptos worked with a leading cybersecurity firm to remove the malware from its systems
Aptos made security updates to the systems, including strengthening access controls
Aptos is actively monitoring the platform to safeguard personal information
Arranged to have AllClear ID protect your identity for twelve (12) months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(140 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMar 7 · first

New Hampshire State AG+14d · this page

Massachusetts State AG+16d

Pattern: first filing Mar 7 (MT), last Mar 23 (MA) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/atwood-distributing-20170321.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2017
Raw hash: b9d194a7c38cecbc0c1eeae8d9e1b601edfe89eab2aef8f4a3a19cb05ccec283

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAtwood Distributing, Inc.

Victim entityAtwood Distributing, Inc.

Incidentdiscovered Nov 1, 2016

Stated responseSent notice by first class mail to the affected consumers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov