MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Mor Furniture For Less, Inc.

bd_510120ab1a60612f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2021

Filed

Dec 9, 2021

To disclose

21 weeks

Affected

731state residents only

Linked

5 filings

Confidence

71%

Full breach record for Mor Furniture For Less, Inc. →

Mor Furniture for Less, Inc. reported a ransomware incident affecting 731 Washington residents. Unauthorized access occurred July 13-16, 2021. Data exposed included names, addresses, SSNs, and financial account numbers. The company engaged forensic investigators, enhanced security controls, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d21 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 21 weeks / 146 days

Jul 13, 2021

Begins

Jul 16, 2021

Discovered

Dec 9, 2021

Filed

vs. sector median

+13 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0992816b679fd5552021-12-09Candidate
Oregon State AGbd_79de44edb14e1c272021-12-09Verified
Montana State AGbd_835e3af25cc8eab42021-12-09Verified
Indiana State AGbd_8c765c3da7d688232021-12-09Verified

Name: Mor Furniture For Less, Inc.
norm: mor furniture for less

Name: Mor Furniture For Less, Inc.
norm: mor furniture for less
Industry: Retail & Consumerllm

Discovered: Jul 16, 2021
Breach occurred: Jul 13, 2021 – Jul 16, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 9, 2021
Affected individuals: 731state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Initiated an internal investigation
Hired a leading computer forensics firm to examine the Mor Furniture network
Engaged a forensic security firm to further investigate the incident
Undertook efforts to reduce the risk of a similar incident occurring in the future
Enhanced its technical security measures
Provided notice of the incident to the potentially involved individuals
Offered twelve (12) months of complimentary credit monitoring and identity theft protection services
Changes made: Implementing additional technical controls
Restoring the affected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(146 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGDec 9 · first

Oregon State AGDec 9 · first

Montana State AGDec 9 · first

Indiana State AGDec 9 · first

Washington State AGDec 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA4204.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2021
Raw hash: d10b1b3a4f146fe9dbdc5c915dc3b58611c98fd62a0ae40e61782b186f899dd5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMor Furniture For Less, Inc.

Victim entityMor Furniture For Less, Inc.

Incidentdiscovered Jul 16, 2021

Stated responseInitiated an internal investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com