HackingRetail & ConsumerRetailStolen CredentialsSkimmerData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowContained

Yummie by Heather Thomson

bd_52ba0c105450d41c · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2016

Filed

Nov 16, 2016

To disclose

15 days

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Yummie by Heather Thomson →

Yummie by Heather Thomson (dba Times Three Clothier, LLC) notified NH AG of a credit card skimming incident. Malicious software was installed on yummielife.com between Oct 4 and Nov 1, 2016, via a compromised third-party vendor account. 7 NH residents affected. Data included names, billing addresses, credit card numbers, and passwords. FBI notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 15 days

Oct 4, 2016

Begins

Nov 1, 2016

Discovered

Nov 16, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_ea53075296b328722016-11-16Verified
Massachusetts State AGbd_7864d9ebe25145482016-11-18 · +2dVerified

Name: Times Three Clothier, LLC
norm: times three clothier
Domain: yummielife.com

Name: Yummie by Heather Thomson
norm: yummie by heather thomson
Domain: yummielife.com
Industry: Retail & Consumerllm

Discovered: Nov 1, 2016
Breach occurred: Oct 4, 2016 – Nov 1, 2016
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 17, 2016
Affected individuals: 7state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1056 Input CaptureT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Reported incident to the Federal Bureau of InvestigationNotified Consumer Protection and Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Something Digital removed the malicious script from Magenta's Miscellaneous Footer HTML
Something Digital removed affected code from the server
Something Digital immediately changed the password for and deactivated the 'michelle' user account
Yummie removed old, unused user accounts and changed passwords for remaining accounts
Something Digital disabled the /downloader directory (admin login)
Something Digital disabled /var directory (cacheleak)
Something Digital disabled directory indexing
Something Digital upgraded WordPress
Something Digital blacklisted IPs that were attempting to access admin
Something Digital whitelisted admin-authorized external IPs
Something Digital changed the Magenta admin route
Something Digital locked the WordPress blog to prevent admin access
Something Digital requested site backups from Rackspace to further investigate issues
Reported incident to the Federal Bureau of Investigation
Changes made: Upgraded WordPress
Changed Magenta admin route
Locked the WordPress blog to prevent admin access
Blacklisted IPs attempting to access admin
Whitelisted admin-authorized external IPs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 16 · first

New Hampshire State AGNov 16 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/times-three-clothier-20161116.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2016
Raw hash: 5e7e85638d2d4f92afc901b4509213a36f8e3932664d4c1f102aea0f27da0568

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTimes Three Clothier, LLC

Victim entityYummie by Heather Thomson

Incidentdiscovered Nov 1, 2016

Stated responseSomething Digital removed the malicious script from Magenta's Miscellaneous Footer HTML

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov