MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Financial accountAuthenticationLowContained

Cherrydale Fundraising

bd_698e79c97840fd76 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 25, 2019

Filed

Mar 19, 2019

To disclose

8 weeks

Affected

20state residents only

Linked

4 filings

Confidence

66%

Full breach record for Cherrydale Fundraising →

Cherrydale Fundraising notified the NH AG of a cyberattack affecting 20 NH residents. Malware compromised credit/debit card data (name, address, card number, CVV) for transactions between Oct 28, 2018 and Jan 25, 2019. The website was taken down, malware removed, and forensic investigators engaged. Notices sent March 15, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 89 days

discovery → filing · 8 weeks / 53 days

Oct 28, 2018

Begins

Jan 25, 2019

Discovered

Mar 19, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_b6ccfee5bb862f242019-03-15 · +4dVerified
California State AGbd_d913c08b0f9200e72019-03-15 · +4dVerified
Montana State AGbd_3e46c0179a85aeb42019-03-14 · +5dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Cherrydale Fundraising
norm: cherrydale fundraising
Industry: Retail & Consumerllm

Discovered: Jan 25, 2019
Breach occurred: Oct 28, 2018 – Jan 25, 2019
Undetected for: 89 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2019
Affected individuals: 20state-resident count only
Data types: Identity (basic)Financial accountAuthentication
Attack vector: Misconfiguration
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Attorney GeneralProviding written notice of this incident to other state regulators, as necessary
Initial access: exploit_public_facing

During the incident: Took the website down to protect the safety of its customers payment information
Began working with third-party forensic investigators
Identified and removed the malware at issue
Safely brought the website back up for customer use
Took steps to confirm the identity of the customers whose personally identifiable information was impacted
Provided written notice of this incident to all affected individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Providing written notice of this incident to other state regulators, as necessary, and to the three major consumer reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Working to review its existing policies and procedures and to implement additional safeguards to further secure payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 14 · first

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+5d · this page

Pattern: first filing Mar 14 (MT), last Mar 19 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cherrydale-20190319.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2019
Raw hash: 1cf2c374d556d1fa36f4eb7add475058ffe04cd19cb9c15c2a0db6700420c40e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCherrydale Fundraising

Incidentdiscovered Jan 25, 2019

Stated responseTook the website down to protect the safety of its customers payment information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov