MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Ballistic Products, Inc.

bd_4e5f71d683ca579d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2022

Filed

Sep 21, 2022

To disclose

8 weeks

Affected

255state residents only

Linked

8 filings

Confidence

66%

Full breach record for Ballistic Products, Inc. →

Ballistic Products, Inc. notified the NH AG of a third-party vendor malware incident. Cardholders using the site between Sept 2020 and Feb 2022 were affected. Data captured included names, payment card numbers, CVVs, and billing addresses. 255 NH residents notified on Sept 1, 2022. Identity theft protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 676 days

discovery → filing · 8 weeks / 57 days

Sep 18, 2020

Begins

Jul 26, 2022

Discovered

Sep 21, 2022

Filed

vs. sector median

on median

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_ea262a4f9f55c5612022-09-21Verified
Maine State AGbd_aaecbad195251dcd2022-09-13 · +8dVerified
Oregon State AGbd_c6b9c657e9d72d472022-09-13 · +8dVerified
California State AGbd_0a9e5025b2e7d8d82022-09-09 · +12dVerified

Show 3 more filings ↓up to 20d gap

Montana State AGbd_6af97512dc8d42cb2022-09-05 · +16dVerified
Washington State AGbd_cc0ec26377c09de62022-09-03 · +18dCandidate
Indiana State AGbd_ee76c2033e23652f2022-09-01 · +20dVerified

Name: Ballistic Products, Inc.
norm: ballistic products

Name: Ballistic Products, Inc.
norm: ballistic products
Industry: Retail & Consumerllm

Discovered: Jul 26, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 676 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 1, 2022
Affected individuals: 255state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: This incident has been reported to law enforcement
Initial access: supply_chain

During the incident: This incident has been reported to law enforcement
Vendor immediately took steps to identify and remove the malware and block any further unauthorized activity
Vendor also promptly launched an extensive investigation with the assistance of data security experts
Offering identity theft protection services through IDX
Changes made: Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGSep 1 · first

Washington State AG+2d

Montana State AG+4d

California State AG+8d

Maine State AG+12d

Oregon State AG+12d

Massachusetts State AG+20d

New Hampshire State AG+20d · this page

Pattern: first filing Sep 1 (IN), last Sep 21 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ballistic-products-20220921.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2022
Raw hash: 1b54960857de361ef7ef8fc447bbc604fa04adedb7206d69fbb53a9882fccc0a

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityBallistic Products, Inc.

Victim entityBallistic Products, Inc.

Incidentdiscovered Jul 26, 2022

Stated responseThis incident has been reported to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov