HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedFinancial accountIdentity (basic)LowActive

Neue Galerie New York

bd_5df46ef3ed7c8385 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 25, 2017

Filed

Oct 5, 2017

To disclose

6 weeks

Affected

7state residents only

Linked

2 filings

Confidence

67%

Full breach record for Neue Galerie New York →

Neue Galerie notified NH AG of a data event affecting 7 NH residents. Malicious code placed on website allowed unauthorized access to credit card info. No evidence of actual access. Discovered Aug 25, 2017. Notification sent Oct 6, 2017. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 41 days

Aug 25, 2017

Discovered

Oct 5, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_f18eaa1b8e072dd62017-10-05Verified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Neue Galerie New York
norm: neue galerie new york
Domain: neuegalerie.org
Industry: Retail & Consumerllm

Discovered: Aug 25, 2017
Materiality determined: —
Notification sent: Oct 6, 2017
Affected individuals: 7state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided notice to certain other state regulators where required
Initial access: exploit_public_facing

During the incident: Took steps to remove the malicious code from its website
Launched an investigation to determine the credit card information potentially accessible
Providing these individuals with helpful information on how to protect against identity theft and fraud
Taking steps to mitigate the risk that an event like this happens again
Provided notice of this incident to certain other state regulators where required
Changes made: Reviewing our policies and procedures
Enhanced the security safeguards on our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 5 · first

New Hampshire State AGOct 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/neue-galerie-20171005.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2017
Raw hash: d36a751dcc2f49a1879ed39f05dc95d7142f7aee738e5f3359a55d76e60ff8f4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityNeue Galerie New York

Incidentdiscovered Aug 25, 2017

Stated responseTook steps to remove the malicious code from its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov