MalwareOtherInfostealerData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Financial accountFinancial credentialsMediumContained

The National Wildlife Federation

bd_53218a1414a3fef4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 4, 2020

Filed

Mar 24, 2021

To disclose

16 weeks

Affected

3,311state residents only

Linked

10 filings

Confidence

71%

Full breach record for The National Wildlife Federation →2 incidents on file

National Wildlife Federation notified Washington AG of a data event affecting 3,311 residents. Malicious code on Zoobooks.com (third-party vendor) captured payment card info (CVV, number) between Feb 2019 and Dec 2020. Discovered Dec 2020; notified March 2021. Remediation included vendor security measures and forensic investigation.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 667 days

discovery → filing · 16 weeks / 110 days

Feb 6, 2019

Begins

Dec 4, 2020

Discovered

Mar 24, 2021

Filed

vs. sector median

+10 wks slower

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_048b6a66df46475b2021-03-24Verified
California State AGbd_616fbe76043ab38a2021-03-24Verified
Maine State AGbd_b39ba2952a25d8d02021-03-24Verified
Indiana State AGbd_c613edfbd878a4cf2021-03-24Verified

Show 5 more filings ↓up to 82d gap

Oregon State AGbd_ddb6c4675f8bd76c2021-03-24Verified
South Carolina State AGbd_e850d4465859eee12021-03-24Verified
Massachusetts State AGbd_f9847d799591af282021-03-24Verified
New Hampshire State AGbd_b0748f215ff0ea602021-03-29 · +5dVerified
Illinois State AGbd_1958b3ed86bc80ad2021-01-01 · +82dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: The National Wildlife Federation
norm: the national wildlife federation
Industry: Otherllm

Discovered: Dec 4, 2020
Breach occurred: Feb 6, 2019 – Dec 10, 2020
Undetected for: 667 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2021
Affected individuals: 3,311state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoing
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1056 Input CaptureT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Provided written notice to the Office of the Attorney GeneralProviding written notice of this incident to other state regulators and the consumer reporting agencies
Initial access: supply_chain

During the incident: Began an investigation to determine the nature and scope of this potential incident
Worked with its third-party vendors to immediately remediate this issue
Retained third party computer forensic specialists
Provided written notice of this incident to affected individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Worked with its third-party vendors to implement additional security measures to further protect the privacy and security of the information in its care
Evaluating additional security measures to mitigate any risk associated with this incident and to better prevent future incidents
Continues to review its security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+82d

California State AG+82d

Maine State AG+82d

Indiana State AG+82d

Oregon State AG+82d

South Carolina State AG+82d

Massachusetts State AG+82d

Washington State AG+82d · this page

New Hampshire State AG+87d

Pattern: first filing Jan 1 (IL), last Mar 29 (NH) — a 87-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10434.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2021
Raw hash: 009e443a22a6b15f2bf8a1f8f8f10998b3b09681a7588afaf54bf0d6bd8fab28

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityThe National Wildlife Federation

Incidentdiscovered Dec 4, 2020

Stated responseBegan an investigation to determine the nature and scope of this potential incident

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com