HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountFinancial credentialsMediumContained

Niibin, LLC

bd_4ff8c1f73cb42a99 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2020

Filed

Oct 14, 2020

To disclose

29 days

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Niibin, LLC →

Niibin, LLC (d/b/a Cash Aisle) notified the NH Attorney General of a data breach involving its third-party provider, Preferred Call Services. An unauthorized individual accessed PCS email accounts containing customer PII (names, SSNs, driver's licenses, bank/payment card data) starting around July 2, 2020. Cash Aisle learned of the compromise on September 15, 2020. Two New Hampshire residents were notified on October 5, 2020. Remediation included password resets, system scans, and offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 75 days

discovery → filing · 29 days

Jul 2, 2020

Begins

Sep 15, 2020

Discovered

Oct 14, 2020

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_0436e48657f304ec2020-10-05 · +9dCandidate
Indiana State AGbd_19e07a3955bb9eef2020-10-05 · +9dVerified
Maine State AGbd_466b86e5286735c72020-10-30 · +16dVerified by operator

Name: Niibin, LLC
norm: niibin

Name: Niibin, LLC
norm: niibin
Also named: Niibin, LLCdba oflegal entity
Cash Aisledba oftrade name
Industry: Financial Servicesllm

Discovered: Sep 15, 2020
Breach occurred: Jul 2, 2020
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 5, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General, Consumer Protection Bureau
Third party: via Preferred Call Services
Initial access: valid_credentials

During the incident: PCS changed the passwords of its email accounts
PCS performed scans on all of its computer systems
PCS updated its domain and user level settings
PCS performed additional computer security changes
PCS engaged a third party cybersecurity firm to manually analyze the impacted information
Cash Aisle offered affected individuals MyIDCare TM identity theft protection services through ID Experts®
Changes made: Cash Aisle remained in constant communication with PCS to ensure its continued commitment to protect the information entrusted in its care
Cash Aisle is working to minimize the impact of the incident and identify additional actions to reduce the risk of it recurring
Cash Aisle will make necessary adjustments to help ensure the security of customer data going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGOct 5 · first

Indiana State AGOct 5 · first

New Hampshire State AG+9d · this page

Maine State AG+25d

Pattern: first filing Oct 5 (MT), last Oct 30 (ME) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/niibin-cash-aisle-20201014.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2020
Raw hash: e574f6e7eeeb705d302514798c048cc32039b3195dedd143cef9b273b20d00b0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNiibin, LLC

Victim entityNiibin, LLC

Incidentdiscovered Sep 15, 2020

Stated responsePCS changed the passwords of its email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov