HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryFinancial accountFinancial credentialsIdentity (basic)CredentialsLowContained

Freedom Management Group, LLC

bd_63ca626a9e0beaf0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 15, 2014

Filed

Aug 12, 2014

To disclose

28 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Freedom Management Group, LLC →

Freedom Management Group, LLC dba The Natural experienced unauthorized access to customer payment card data on its online store between April 22 and July 17, 2014. The company discovered the intrusion on July 15, 2014, when criminals forced their way into the system. Compromised data included credit/debit card numbers, expiration dates, CVVs, names, addresses, phone numbers, emails, and account passwords. The company closed the access point, removed malware, and offered 12 months of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 15, 2014 → Notified Aug 12, 201428d ✓ CA 60-day OK28 days discovery → filing

Incident timeline

undetected · 84 days

discovery → filing · 28 days

Apr 22, 2014

Begins

Jul 15, 2014

Discovered

Aug 12, 2014

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_815dc8b1b9af3a612014-08-19 · +7dVerified
Massachusetts State AGbd_44a168344fd756552014-08-20 · +8dVerified

Name: Freedom Management Group, LLC
norm: freedom management
Domain: thenaturalonline.com

Name: Freedom Management Group, LLC
norm: freedom management
Domain: thenaturalonline.com
Also named: Freedom Management Group, LLCdba oflegal entity
The Naturaldba oftrade name
Industry: Retail & Consumerllm

Discovered: Jul 15, 2014
Breach occurred: Apr 22, 2014 – Jul 17, 2014
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2014
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified attorney generals
Initial access: exploit_public_facing

During the incident: Started a forensic investigation
Closed the access point that the criminals used
Removed the malware they left behind
Alerted financial institutions immediately after confirming the unauthorized access
Notified the necessary credit card companies, credit bureaus and attorney generals
Changes made: Implemented additional security measures and procedures to reduce the likelihood that this ever happens again
Arranged to have AllClear ID protect your identity for 12 months, at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: CA 60-day OK · 28d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 15, 2014
→ Notified: Aug 12, 2014
28d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 15, 2014 → Notified: Aug 12, 2014	28d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGAug 12 · first · this page

New Hampshire State AG+7d

Massachusetts State AG+8d

Pattern: first filing Aug 12 (CA), last Aug 20 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-46191
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2014
Raw hash: 833ef3ea9220afd86d4ef219e03aecc64d588f8a4bc00245128fdb6319d2e13c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFreedom Management Group, LLC

Victim entityFreedom Management Group, LLC

Incidentdiscovered Jul 15, 2014

Stated responseStarted a forensic investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov