MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIPCIIdentity (basic)Financial accountLowContained

Plow and Hearth, LLC

bd_6d744984c173a339 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 6, 2017

Filed

Mar 14, 2017

To disclose

5 weeks

Affected

345state residents only

Linked

4 filings

Confidence

64%

Full breach record for Plow and Hearth, LLC →3 incidents on file

Plow & Hearth notified customers that its e-commerce platform provider, Aptos, Inc., experienced a malware intrusion between Feb and Dec 2016. The incident compromised customer PII and payment card data for transactions from 2013-2016. No evidence of misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 371 days

discovery → filing · 5 weeks / 36 days

Feb 1, 2016

Begins

Feb 6, 2017

Discovered

Mar 14, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_8d419f66b199915f2017-03-10 · +4dVerified
Washington State AGbd_6e0712cdfba6e0502017-02-25 · +17dCandidate
Hawaii State AGbd_19150b43ddb22ef82017-04-11 · +28dVerified

Name: Plow and Hearth, LLC
norm: plow and hearth
Domain: plowandhearth.com

Name: Plow and Hearth, LLC
norm: plow and hearth
Domain: plowandhearth.com
Industry: Retail & Consumerllm

Discovered: Feb 6, 2017
Breach occurred: Feb 1, 2016 – Dec 31, 2016
Undetected for: 371 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 345state-resident count only
Data types: PIIPCIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Aptos, Inc.
Initial access: external_remote_services

During the incident: Aptos is working with a leading cybersecurity firm
Aptos has taken steps to secure systems
Aptos is working with law enforcement authorities
Credit card companies and issuing banks are being contacted
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGFeb 25 · first

Oregon State AG+13d

Montana State AG+17d · this page

Hawaii State AG+45d

Pattern: first filing Feb 25 (WA), last Apr 11 (HI) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Plow-Hearth.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 14, 2017
Raw hash: dc648bebec8a22d7f0ec562118069cf764be83ff7cafccc6a3cc536e6bacf3c4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPlow and Hearth, LLC

Victim entityPlow and Hearth, LLC

Incidentdiscovered Feb 6, 2017

Stated responseAptos is working with a leading cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov