HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Backcountry Edge, Inc.

bd_49e5ad4800c7b41c · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 26, 2018

Filed

Dec 5, 2018

To disclose

9 days

Affected

6state residents only

Linked

2 filings

Confidence

67%

Full breach record for Backcountry Edge, Inc. →2 incidents on file

Backcountry Edge, Inc. notified the NH Attorney General of a security breach affecting 6 NH residents. Malicious code on their website exposed names, addresses, emails, and payment card numbers. Discovered Nov 26, 2018. Malware removed, security enhancements implemented, and credit monitoring offered via CyberScout.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Nov 26, 2018

Discovered

Dec 5, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_809adefab5be8d442018-12-11 · +6dVerified

Name: Backcountry Edge, Inc.
norm: backcountry edge
Domain: backcountryedge.com

Name: Backcountry Edge, Inc.
norm: backcountry edge
Domain: backcountryedge.com
Industry: Retail & Consumerllm

Discovered: Nov 26, 2018
Materiality determined: —
Notification sent: Dec 11, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: The malicious software has been removed as of November 26, 2018 from our website
Implemented security measures to ensure the confidentiality of the personal information
Support provider took immediate steps to shut down unauthorized access to our website
Made immediate enhancements to our systems, security and practices
Working with our support provider to implement additional tools designed to identify this type of threat
Providing you with access to a fraud specialist to assist with any questions
Services will be provided by CyberScout
Changes made: Implemented security measures to ensure the confidentiality of the personal information
Made immediate enhancements to our systems, security and practices
Working with our support provider to implement additional tools designed to identify this type of threat and prevent it from happening
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 5 · first · this page

Montana State AG+6d

Pattern: first filing Dec 5 (NH), last Dec 11 (MT) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/backcountry-edge-20181205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2018
Raw hash: 67cef3f657cb1b813a8b686828f1e59c2fdb20c2d93defe07726dbbce4fe6e39

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBackcountry Edge, Inc.

Victim entityBackcountry Edge, Inc.

Incidentdiscovered Nov 26, 2018

Stated responseThe malicious software has been removed as of November 26, 2018 from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov