HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountLowContained

Heirloom Roses

bd_51464c0d5acb0187 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 12, 2021

Filed

Dec 23, 2021

To disclose

19 weeks

Affected

266state residents only

Linked

9 filings

Confidence

66%

Full breach record for Heirloom Roses →

Heirloom Roses notified the NH AG of a security incident where malicious code on its website captured customer credit card data and names from Feb-Oct 2021. Discovered Aug 12, 2021. 266 NH residents affected. Remediation included removing code, new payment processor, and offering 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 192 days

discovery → filing · 19 weeks / 133 days

Feb 1, 2021

Begins

Aug 12, 2021

Discovered

Dec 23, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_3c6bde4e9111e4832021-12-17 · +6dVerified
Oregon State AGbd_6534d6c864b8f2ca2021-12-17 · +6dVerified
California State AGbd_660ee01c3e82267e2021-12-17 · +6dVerified
Montana State AGbd_967abeb7c36a4e582021-12-17 · +6dVerified

Show 4 more filings ↓up to 356d gap

Washington State AGbd_c9b21be8111f06ec2021-12-17 · +6dVerified
Massachusetts State AGbd_ddc8131d0fee95fd2021-12-17 · +6dVerified
Indiana State AGbd_f6f92f81ea61beb52021-12-17 · +6dVerified
Illinois State AGbd_98e2cfac9ef7eece2021-01-01 · +356dCandidate

Name: Heirloom Roses
norm: heirloom roses

Name: Heirloom Roses
norm: heirloom roses
Industry: Retail & Consumerllm

Discovered: Aug 12, 2021
Breach occurred: Feb 1, 2021 – Oct 26, 2021
Undetected for: 192 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 17, 2021
Affected individuals: 266state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Provided notification to the New Hampshire Office of Attorney General
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists to assist with a thorough investigation
Removed the malicious code
Implemented additional security measures
Transitioned to a new payment processor
Changes made: Implemented additional security measures
Transitioned to a new payment processor to prevent a similar incident from occurring in the future
Continues to review its policies and procedures related to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(133 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+350d

Oregon State AG+350d

California State AG+350d

Montana State AG+350d

Washington State AG+350d

Massachusetts State AG+350d

Indiana State AG+350d

New Hampshire State AG+356d · this page

Pattern: first filing Jan 1 (IL), last Dec 23 (NH) — a 356-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/heirloom-roses-20211223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2021
Raw hash: d0976da4730548c556ec81e4a56a86455c1c9e8327e72c3a35a3f42b9371fc00

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityHeirloom Roses

Victim entityHeirloom Roses

Incidentdiscovered Aug 12, 2021

Stated responseEngaged third-party forensic specialists to assist with a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov