HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowActive

Dutch

bd_4f7d406f76e35595 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 9, 2017

Filed

Aug 17, 2017

To disclose

10 weeks

Affected

26state residents only

Linked

4 filings

Confidence

66%

Full breach record for Dutch →

Dutch, LLC notified the NH AG of a cyber-attack on its e-commerce sites (Joie.com and Equipmentfr.com) affecting 26 NH residents. Malicious files collected names, addresses, card numbers, expiration dates, and CVVs. Occurred between June 2016 and Jan 2017. Discovered June 2017. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 365 days

discovery → filing · 10 weeks / 69 days

Jun 9, 2016

Begins

Jun 9, 2017

Discovered

Aug 17, 2017

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_abd1aa8a6fa5dbff2017-08-17Candidate
California State AGbd_c7efe490d9e3d5832017-08-17Verified
Massachusetts State AGbd_afe0e8e00e57526a2017-08-18 · +1dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Dutch
norm: dutch
Domain: dutch.com
Industry: Retail & Consumerllm

Discovered: Jun 9, 2017
Breach occurred: Jun 9, 2016 – Jan 26, 2017
Undetected for: 365 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 17, 2017
Affected individuals: 26state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided notice to certain other state regulators
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic investigators
Provided notice to state regulators
Removed the malicious files at issue
Changes made: Implemented additional procedures to further protect the security of customer debit and credit cards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGAug 17 · first

California State AGAug 17 · first

New Hampshire State AGAug 17 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/dutch-20170817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2017
Raw hash: 35729ebeffeba4e27952d35e3710547e83c534e4a0cfd19c4352accb03aa1413

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityDutch

Incidentdiscovered Jun 9, 2017

Stated responseEngaged third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov