HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedIdentity (basic)Financial accountLowContained

The Image Group

bd_6397e0e7e96f9545 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 17, 2017

Filed

Nov 28, 2017

To disclose

11 days

Affected

1state residents only

Confidence

66%

Full breach record for The Image Group →2 incidents on file

The Image Group notified the NH Attorney General of a security vulnerability in its eCommerce platform's Payflow Pro payment processing between Oct 17 and Nov 17, 2017. One NH resident's name, email, address, and credit card info were potentially intercepted. The company engaged forensic experts, notified the FBI, and upgraded its payment system.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 11 days

Oct 17, 2017

Begins

Nov 17, 2017

Discovered

Nov 28, 2017

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: The Image Group
norm: the image
Domain: theimagegroup.espwebsite.com

Name: The Image Group
norm: the image
Domain: theimagegroup.espwebsite.com
Industry: Retail & Consumerllm

Discovered: Nov 17, 2017
Breach occurred: Oct 17, 2017 – Nov 17, 2017
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 28, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Engaged a third-party expert
Notified the Federal Bureau of Investigation
Upgraded to a different PayPal payment card processing system
Changes made: Upgraded to a different PayPal payment card processing system that does not contain such vulnerability
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 days(11 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/image-group-20171128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2017
Raw hash: a085bad91b635845db0cab74b965ad2e958155ba9a005a6c336da479dc51ecc8

Reporting entityThe Image Group

Victim entityThe Image Group

Incidentdiscovered Nov 17, 2017

Stated responseEngaged a third-party expert

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov