HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Historical Emporium, inc

bd_65951ba55a941667 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 21, 2019

Filed

Jun 7, 2019

To disclose

17 days

Affected · nationwide

4,50025 in this filing

Linked

2 filings

Confidence

65%

Full breach record for Historical Emporium, inc →

Historical Emporium, Inc. notified the New Hampshire Attorney General of a data breach affecting approximately 4,500 customers. Unauthorized code (malware) was embedded in the website's shopping cart between March 2, 2019, and May 21, 2019, exposing payment card numbers, names, billing addresses, and expiration dates. The company discovered the breach on May 21, 2019, removed the code, secured systems, and notified affected residents on May 31, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 80 days

discovery → filing · 17 days

Mar 2, 2019

Begins

May 21, 2019

Discovered

Jun 7, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_f5cb3043f44033e82019-06-04 · +3dCandidate

Name: Historical Emporium, inc
norm: historical emporium
Domain: historicalemporium.com

Name: Historical Emporium, inc
norm: historical emporium
Domain: historicalemporium.com
Industry: Retail & Consumerllm

Discovered: May 21, 2019
Breach occurred: Mar 2, 2019 – May 21, 2019
Undetected for: 80 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 31, 2019
Affected individuals: 4,500state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: exploit_public_facing

During the incident: Discovered and removed the unauthorized code
Took immediate steps to secure the affected part of our systems
Conducted an internal investigation
Reported the details of this breach to the payment card brands
Reported the details of this breach to law enforcement
Changes made: Limit access to our shopping cart administrative function to only a short list of IP addresses
Monitoring our entire shopping cart code base for any unauthorized changes
Taken additional steps to enhance security and monitoring of sensitive systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGJun 4 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/historical-emporium-20190607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2019
Raw hash: a4cc0e37e05dc669f7cc460430208670f9b346cae7fa386672c203ff009a1356

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHistorical Emporium, inc

Victim entityHistorical Emporium, inc

Incidentdiscovered May 21, 2019

Stated responseDiscovered and removed the unauthorized code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov