HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowActive

Apple Leisure Group

bd_48d17a976a120bfb · schema v1 · pii pii-v1

Severity

Low

Discovered

May 6, 2014

Filed

Dec 15, 2014

To disclose

32 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Apple Leisure Group →

Apple Leisure Group notified the NH AG of a data security event affecting 1 NH resident. Suspicious credit card activity reported May 6, 2014. Unauthorized access to name, address, credit card info, phone, email, DOB possible. Forensic experts retained. Credit monitoring offered. Process changes implemented to block credit card access.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 223 days

May 6, 2014

Discovered

Dec 15, 2014

Filed

vs. sector median

+24 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_ea4deee66ba2caf72014-12-15Candidate

Name: Apple
norm: apple
Domain: apple.com

Name: Apple Leisure Group
norm: apple leisure
Industry: Retail & Consumerllm

Discovered: May 6, 2014
Materiality determined: —
Notification sent: Dec 15, 2014
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided written notice to other state regulators, international regulators, and national consumer reporting agencies
Initial access: valid_credentials

During the incident: Retained third-party forensic experts to assist with the investigation
Notified online booking vendor
Changed processes so that access to credit card information is no longer possible
Sent written notice to affected individuals
Offered one year of credit monitoring services and identity restoration services
Provided information on how to protect against identity theft and fraud
Provided written notice to other state regulators, international regulators, and national consumer reporting agencies
Changes made: Changed processes so that access to credit card information is no longer possible
Reviewing its processes and enhancing its policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(223 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

New Hampshire State AGDec 15 · first

New Hampshire State AGDec 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/amr-resorts-20141215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2014
Raw hash: da55f048bd2f1dfa0ceb46049dc568111ec948284e14beb5e5ed19d805e487d8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityApple

Victim entityApple Leisure Group

Incidentdiscovered May 6, 2014

Stated responseRetained third-party forensic experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov