HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowResolved

HARBOR FREIGHT TOOLS USA, INC.

bd_63bf7f80ae6eb6b6 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 31, 2013

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for HARBOR FREIGHT TOOLS USA, INC. →

Harbor Freight Tools USA, Inc. disclosed that its payment processing system was illegally attacked by cyber-criminals between May 6, 2013, and June 30, 2013. The attacker exfiltrated 'track 2' magnetic stripe data (card account number, expiration date, and card verification number) from credit and debit card transactions. For less than 1% of transactions, cardholder names may also have been accessed. The company engaged a cybersecurity firm, blocked the attack, and implemented enhanced security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

May 6, 2013

Begins

Oct 31, 2013

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_6e5ed85d8950774a2013-10-31Verified
Massachusetts State AGbd_c4cd15113e5f36552013-11-01 · +1dVerified

Name: HARBOR FREIGHT TOOLS USA, INC.
norm: harbor freight tools usa

Name: HARBOR FREIGHT TOOLS USA, INC.
norm: harbor freight tools usa
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 6, 2013 – Jun 30, 2013
Materiality determined: —
Notification sent: Oct 31, 2013
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a leading cyber-security company to investigate
Posted notices in every store and on our website
Blocked the attack
Adopted enhanced security measures to make our systems more secure
Changes made: Adopted enhanced security measures to make our systems more secure
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 31 · first

California State AGOct 31 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-43161
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 31, 2013
Raw hash: b3277439fb27938448838c76f675f43ef5c36e095bf795966ddb8011eaac9d0e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHARBOR FREIGHT TOOLS USA, INC.

Victim entityHARBOR FREIGHT TOOLS USA, INC.

IncidentUnauthorized Access

Stated responseEngaged a leading cyber-security company to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov