HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Welders Supply

bd_53607d9da0fea99a · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 6, 2018

Filed

Jan 10, 2019

To disclose

5 weeks

Affected

18state residents only

Linked

3 filings

Confidence

66%

Full breach record for Welders Supply →2 incidents on file

Welders Supply Company notified NH AG of a breach at third-party host iNET exposing customer credit card data (numbers, CVV, expiration) and PII. Incident began ~Nov 14, 2018, discovered Dec 6, 2018. 18 NH residents affected. Notices mailed Jan 9, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 5 weeks / 35 days

Nov 14, 2018

Begins

Dec 6, 2018

Discovered

Jan 10, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_5dad1d2314069c022019-01-09 · +1dCandidate
Massachusetts State AGbd_50b87a419c6122e22019-01-16 · +6dVerified

Name: Welders Supply
norm: welders supply
Domain: weldersupply.com

Name: Welders Supply
norm: welders supply
Domain: weldersupply.com
Industry: Retail & Consumerllm

Discovered: Dec 6, 2018
Breach occurred: Nov 14, 2018
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 9, 2019
Affected individuals: 18state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via iNET
Initial access: exploit_public_facing

During the incident: Notified iNET of the calls on December 6, 2018
Notified credit card payment processor of the incident
Providing information about Identity Theft Protection with each notification letter
Changes made: INET remediated the vulnerability
INET assigned a programmer to monitor Welders Supply's website with security analysis software
Scheduled software to be in a "monitor only" mode
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJan 9 · first

New Hampshire State AG+1d · this page

Massachusetts State AG+7d

Pattern: first filing Jan 9 (MT), last Jan 16 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/welders-supply-20190110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2019
Raw hash: f731abc90696620585f69239265560a193e8c4ed3f7c0a5c22b09a7bd0cf7b15

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWelders Supply

Victim entityWelders Supply

Incidentdiscovered Dec 6, 2018

Stated responseNotified iNET of the calls on December 6, 2018

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov