HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountFinancial credentialsLowContained

Carroll Saints Shoppe (PrismRBS)

bd_5aa70c66ea931531 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 1, 2019

To disclose

—

Affected

7state residents only

Confidence

67%

Full breach record for Carroll Saints Shoppe (PrismRBS) →

Carroll Saints Shoppe, a retailer operated by Carroll College, notified customers of a data breach involving its eCommerce provider, PrismRBS. Between Jan 19-26, 2019, an unauthorized party installed malware on servers to capture payment card data (names, numbers, CVVs). No SSNs or driver's licenses were affected. PrismRBS engaged forensic investigators and offered one year of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 19, 2019

Begins

Mar 1, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7 affectedView incident

Name: Carroll College
norm: carroll college
Domain: carroll.edu

Name: Carroll Saints Shoppe (PrismRBS)
norm: carroll saints shoppe prismrbs
Domain: saintsshoppe.carroll.edu
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 19, 2019 – Jan 26, 2019
Materiality determined: —
Notification sent: Mar 1, 2019
Affected individuals: 7state-resident count only
Data types: Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Third party: via PrismRBS
Initial access: exploit_public_facing

During the incident: Engaged a leading cybersecurity firm to assist in their investigation
Implemented several additional security measures to help prevent this type of incident from reoccurring
Offering one year of identity protection services through IdentityWorks
Changes made: Implemented several additional security measures to help prevent this type of incident from reoccurring
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-2019-03-01-Notification-of-Data-Breach-Carroll-College.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2019
Raw hash: 0337e94a4b4173d1c0e85f7b6839787be219428f24d587d8b56b3628c903781a

Reporting entityCarroll College

Victim entityCarroll Saints Shoppe (PrismRBS)

IncidentThird-Party / Supply Chain

Stated responseEngaged a leading cybersecurity firm to assist in their investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov