HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountLowContained

MT. HOOD MEADOWS OREG., LLC

bd_613ac404b9a9d1fe · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 9, 2023

Filed

Oct 27, 2023

To disclose

33 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for MT. HOOD MEADOWS OREG., LLC →2 incidents on file

Mount Hood Meadows Oregon, LLC notified consumers of a data breach where an unauthorized third party exploited code modification on the web server to access customer data. The incident affected individuals who made purchases between Feb 21 and Mar 14, 2023, exposing names, addresses, and credit card info. The company engaged forensic investigators, notified the FBI, replaced its website platform, and offered one year of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday33 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 16 days

discovery → filing · 33 weeks / 232 days

Feb 21, 2023

Begins

Mar 9, 2023

Discovered

Oct 27, 2023

Filed

vs. sector median

+26 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_db799a03efa250802023-10-27Verified
Washington State AGbd_0ac1d3fa19ead1ac2023-11-01 · +5dCandidate
Montana State AGbd_0ed387233cbddd3c2023-11-01 · +5dVerified
Massachusetts State AGbd_56857575236fb0d32023-11-01 · +5dVerified

Show 1 more filing ↓up to 13d gap

New Hampshire State AGbd_3168f30fd40a79092023-11-09 · +13dVerified

Name: MT. HOOD MEADOWS OREG., LLC
norm: mt hood meadows oreg

Name: MT. HOOD MEADOWS OREG., LLC
norm: mt hood meadows oreg
Industry: Retail & Consumerllm

Discovered: Mar 9, 2023
Breach occurred: Feb 21, 2023 – Mar 14, 2023
Undetected for: 16 daysoccurrence → discovery
Materiality determined: Oct 27, 2023
Notification sent: Oct 27, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted the FBI to report the potential compromise
Initial access: exploit_public_facing

During the incident: Engaged in a comprehensive forensic investigation
Took down the website until it was secure
Mitigated attempts to gain access to guest information
Contacted the FBI to report the potential compromise
Replaced entire website partnering with BigCommerce
Had a security audit of network from CFC Response
Reviewed and enhanced policies and procedures relating to security of systems and servers
Secured services of Kroll to provide identity monitoring at no cost for one year
Changes made: Replaced entire website partnering with BigCommerce
Had a security audit of network from CFC Response
Reviewed and enhanced policies and procedures relating to security of systems and servers
Enhanced information life cycle management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(232 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 27 · first

Vermont State AGOct 27 · first · this page

Washington State AG+5d

Montana State AG+5d

Massachusetts State AG+5d

New Hampshire State AG+13d

Pattern: first filing Oct 27 (IN), last Nov 9 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-10-27-mt-hood-meadows-oregon-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 27, 2023
Raw hash: 95939f267496156f102e8f06f97cfcd90fcb28ba8bd0c5d0b41b631b770b148b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMT. HOOD MEADOWS OREG., LLC

Victim entityMT. HOOD MEADOWS OREG., LLC

Incidentdiscovered Mar 9, 2023

Stated responseEngaged in a comprehensive forensic investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov