HackingRetail & ConsumerRetailVulnerability ExploitRansomwareData ExfiltratedTargetedFinancial accountIdentity (basic)LowContained

Native Canada Footwear Ltd

bd_4a5013b9e659def8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 23, 2017

Filed

Aug 16, 2017

To disclose

8 weeks

Affected

70state residents only

Linked

4 filings

Confidence

66%

Full breach record for Native Canada Footwear Ltd →

Native Canada Footwear Ltd (Native Shoes) notified the NH AG of a malware infection on its website from April 2015 to June 2023. The malware potentially exposed payment card info and PII of ~70 NH customers. The company took systems offline, engaged forensic investigators, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 814 days

discovery → filing · 8 weeks / 54 days

Apr 1, 2015

Begins

Jun 23, 2017

Discovered

Aug 16, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_78b8f2a95081d7602017-08-16Verified
California State AGbd_84277d36ba17dbca2017-08-16Verified
Oregon State AGbd_3d1bdb0ce31171622017-09-08 · +23dCandidate

Name: Lane Powell PC
norm: lane powell

Name: Native Canada Footwear Ltd
norm: native canada footwear
Industry: Retail & Consumerllm

Discovered: Jun 23, 2017
Breach occurred: Apr 1, 2015 – Jun 23, 2017
Undetected for: 814 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 16, 2017
Affected individuals: 70state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Took the system offline
Hired well-respected forensics firms to conduct a full investigation
Informed relevant law enforcement and regulatory authorities
Launched a dedicated website
Established a dedicated telephone hotline
Offering consumers a year of credit monitoring
Changes made: Conducting a thorough review of its electronic systems
Retained respected forensic and cyber security professionals to test its electronic systems
Upgrade security efforts across Native Shoes’s electronic systems
Developing a new online shopping site, which will run on an entirely redesigned and upgraded platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 16 · first

California State AGAug 16 · first

New Hampshire State AGAug 16 · first · this page

Oregon State AG+23d

Pattern: first filing Aug 16 (MA), last Sep 8 (OR) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/native-canada-20170816.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2017
Raw hash: ed310fd26581178d8b82fd2e809453bed55d023b24551e3bcf4c63c5cb982dd9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityLane Powell PC

Victim entityNative Canada Footwear Ltd

Incidentdiscovered Jun 23, 2017

Stated responseTook the system offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov