HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

X-Rite Incorporated

bd_56f974ab8e0aa90c · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 23, 2012

Filed

Apr 9, 2012

To disclose

17 days

Affected

337state residents only

Linked

3 filings

Confidence

66%

Full breach record for X-Rite Incorporated →

X-Rite Incorporated notified the New Hampshire Attorney General of a breach affecting 337 NH residents. Unauthorized access began approx. Feb 6, 2012; discovered March 23, 2012. Attackers accessed a database server containing names, contact info, and credit card data. X-Rite disabled the server, rebuilt hardware, changed passwords, and notified law enforcement. Notifications sent April 6, 2012, offering 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 17 days

Feb 6, 2012

Begins

Mar 23, 2012

Discovered

Apr 9, 2012

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_36de93902c2a44d62012-04-11 · +2dVerified
Massachusetts State AGbd_4210d46f3b95c1b72012-04-11 · +2dVerified

Name: Winston & Strawn LLP
norm: winston strawn

Name: X-Rite Incorporated
norm: x rite
Industry: Retail & Consumerllm

Discovered: Mar 23, 2012
Breach occurred: Feb 6, 2012
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2012
Affected individuals: 337state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Disabled the server
Notified law enforcement
Completely rebuilt the affected servers with all new hardware
Changed all of its internal passwords
Initiated additional security measures, including conducting more frequent security audits and scans of its databases
Changes made: Conducting more frequent security audits and scans of its databases
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 9 · first · this page

California State AG+2d

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/x-rite-20120409.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2012
Raw hash: 799c65b69e08464634e778e1873253676b466b7b6941d1cb405063d11fe53d80

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWinston & Strawn LLP

Victim entityX-Rite Incorporated

Incidentdiscovered Mar 23, 2012

Stated responseDisabled the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov