HackingStolen CredentialsCustomer Data InvolvedTargetedPIIIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Dollar Shave Club, Inc.
bd_58c31c482986c6f5 · schema v1 · pii pii-v1
Full breach record for Dollar Shave Club, Inc. →Dollar Shave Club, Inc. notified the New Hampshire Attorney General of a credential-stuffing incident affecting 7 NH residents. Between May 26 and June 13, 2018, unauthorized actors used stolen email/password combinations to access customer accounts, view PII (name, address, email, phone), and purchase e-gift cards using hashed payment card data (last 4 digits only). The company disabled accounts, reset passwords, refunded purchases, voided codes, blocked IPs, and filed an FBI IC3 complaint.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_52f63accd9eaa6f2Montana State AGfiled 2018-07-16(19d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/dollar-shave-20180627.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 27, 2018
- Raw hash
- 18714b438211b2642775a0bc12170d23e574c4785050786019caec3152c133fb
Reporting entity
- Name
- Dollar Shave Club, Inc.norm: dollar shave club
- Domain
- dollarshaveclub.com
Victim entity
- Name
- Dollar Shave Club, Inc.norm: dollar shave club
- Domain
- dollarshaveclub.com
Incident
- Discovered
- Jun 13, 2018
- Materiality determined
- —
- Notification sent
- Jun 20, 2018
- Affected individuals
- 7
- Data types
- PIIIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1530 Data from Cloud Storage Object
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed a complaint with the FBI's Internet Crime Complaint Center
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 14 days(14 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.