HackingRetail & ConsumerRetailBackdoor / C2Abuse Of FunctionalityTargetedData ExfiltratedIdentity (basic)Financial accountLowActive

B.T.C.E., Inc.

bd_48890340036d0481 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 7, 2018

Filed

Apr 11, 2018

To disclose

5 weeks

Affected

8state residents only

Confidence

67%

Full breach record for B.T.C.E., Inc. →3 incidents on file

B.T.C.E., Inc. d/b/a HomeBrewIt.com notified the NH AG of a security incident where an unauthorized party accessed its hosting environment and executed malicious code on its website. The breach, discovered March 7, 2018, affected 8 NH residents, exposing names, addresses, and payment card info. The company offered 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 162 days

discovery → filing · 5 weeks / 35 days

Sep 26, 2017

Begins

Mar 7, 2018

Discovered

Apr 11, 2018

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8 affectedView incident

Name: B.T.C.E., Inc.
norm: btce

Name: B.T.C.E., Inc.
norm: btce
Also named: B.T.C.E., Inc.dba oflegal entity
HomeBrewIt.comdba oftrade name
Industry: Retail & Consumerllm

Discovered: Mar 7, 2018
Breach occurred: Sep 26, 2017
Undetected for: 162 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Advised the affected customers about the incident
Offered complimentary identity theft protection services to the affected New Hampshire residents through CyberScout for twelve (12) months
Hosting company immediately quarantined the malicious code and stopped any further leaking of information
Additional security enhancements were added to our website to block points of entry that the attackers used
Hosting company has also implemented more robust monitoring tools to identify this type of breach
Changes made: Implementing security enhancements as needed
Working closely with hosting company to make sure something like this never happens again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/btce-20180411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2018
Raw hash: d9140e72fa11bb542646a32f60f24a4c817d555fdd563dccbb0e97a13a5c2e48

Reporting entityB.T.C.E., Inc.

Victim entityB.T.C.E., Inc.

Incidentdiscovered Mar 7, 2018

Stated responseAdvised the affected customers about the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov