MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedPCIFinancial accountFinancial credentialsLowContained

ECS Tuning, Inc.

bd_5525b261a7457943 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 2, 2022

Filed

Jun 7, 2022

To disclose

14 weeks

Affected

74state residents only

Linked

5 filings

Confidence

66%

Full breach record for ECS Tuning, Inc. →2 incidents on file

ECS Tuning, LLC DBA Rennline Automotive notified NH AG of a data security incident involving its former e-commerce vendor, Freestyle Solutions, Inc. Malware on Freestyle's systems compromised payment card data (names, numbers, CVV, billing addresses) for transactions between Sept 2020 and Feb 2022. 74 NH residents were notified. Rennline switched vendors and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 527 days

discovery → filing · 14 weeks / 97 days

Sep 21, 2020

Begins

Mar 2, 2022

Discovered

Jun 7, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_3a1fb13cd2f8cbd02022-06-03 · +4dVerified
Massachusetts State AGbd_751ae6e0826c703c2022-06-03 · +4dVerified
Montana State AGbd_7d9d4000374244ee2022-06-03 · +4dCandidate
California State AGbd_ba9fac1aef7790c82022-06-03 · +4dVerified

Name: ECS Tuning, Inc.
norm: ecs tuning

Name: ECS Tuning, Inc.
norm: ecs tuning
Also named: ECS Tuning, LLCdba oflegal entity
Rennline Automotivedba oftrade name
Industry: Retail & Consumerllm

Discovered: Mar 2, 2022
Breach occurred: Sep 21, 2020 – Feb 3, 2022
Undetected for: 527 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2022
Affected individuals: 74state-resident count only
Data types: PCIFinancial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralNotified law enforcement authoritiesNotified payment card companies
Initial access: supply_chain

During the incident: Conducted a diligent investigation to identify and notify potentially affected customers promptly
Confirmed that law enforcement authorities and payment card companies have been notified
Stopped using Freestyle for its e-commerce website
Moved its website to a new third-party provider’s platform
Changes made: Stopped using Freestyle for its e-commerce website
Moved its website to a new third-party provider’s platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 3 · first

Massachusetts State AGJun 3 · first

Montana State AGJun 3 · first

California State AGJun 3 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ecs-tuning-dba-rennline-automotive-20220607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2022
Raw hash: 7c7c2bb4817572f71c6b3623a28685e4b14fac33b537ffc4499dae7d7cb6da1a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityECS Tuning, Inc.

Victim entityECS Tuning, Inc.

Incidentdiscovered Mar 2, 2022

Stated responseConducted a diligent investigation to identify and notify potentially affected customers promptly

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov