HackingRetail & ConsumerRetailSQL InjectionData ExfiltratedCustomer Data InvolvedPIIFinancial accountCredentialsLowContained

MLSGear.com

bd_484016414d72ea4c · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2008

Filed

Feb 1, 2008

To disclose

≤1 day

Affected

169state residents only

Confidence

66%

Full breach record for MLSGear.com →

MLSGear.com notified the New Hampshire Attorney General on February 1, 2008, regarding unauthorized access to customer data between January and August 2007. Approximately 169 New Hampshire residents were affected. The breach involved SQL Injection attacks targeting a third-party service provider, exposing names, addresses, credit/debit card info, and passwords. MLSGear terminated the provider, purged passwords, and offered one year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 396 days

discovery → filing · ≤1 day / 0 days

Jan 1, 2007

Begins

Feb 1, 2008

Discovered

Feb 1, 2008

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed169 affectedView incident

Name: MLSGear.com
norm: mlsgearcom

Name: MLSGear.com
norm: mlsgearcom
Industry: Retail & Consumerllm

Discovered: Feb 1, 2008
Breach occurred: Jan 1, 2007 – Aug 31, 2007
Undetected for: 396 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2008
Affected individuals: 169state-resident count only
Data types: PIIFinancial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Terminating relationship with third-party e-commerce provider
Purging all passwords
Strengthening security measures to safeguard privacy of customer personal and credit information
Contacted federal law enforcement (FBI)
Working with VISA, Mastercard, and Chase Paymentech
Changes made: Offering one year of credit monitoring services and credit restoration with Kroll Background America, Inc.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mlsgear-20080201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2008
Raw hash: 0cc920ebede3497bdac9cdd375042a85dc48aa1e849439f6683ce9431b6b888c

Reporting entityMLSGear.com

Victim entityMLSGear.com

Incidentdiscovered Feb 1, 2008

Stated responseTerminating relationship with third-party e-commerce provider

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov