HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Simon Pearce Inc

bd_6dedd4cd2a438e06 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 28, 2019

Filed

May 8, 2019

To disclose

6 weeks

Affected

11state residents only

Linked

3 filings

Confidence

67%

Full breach record for Simon Pearce Inc →

Simon Pearce (US) Inc. notified the NH Attorney General that an unauthorized third party injected malicious code into its e-commerce platform, potentially capturing customer names, addresses, and credit card/CVV data. 11 NH residents were affected. The code was removed, law enforcement and forensic firms were engaged, and credit card brands were alerted.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 41 days

Mar 28, 2019

Discovered

May 8, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_62dd82d11467c1892019-05-07 · +1dVerified
Montana State AGbd_e340f93c3dbb075c2019-05-07 · +1dCandidate

Name: Polsinelli PC
norm: polsinelli

Name: Simon Pearce Inc
norm: simon pearce
Industry: Retail & Consumerllm

Discovered: Mar 28, 2019
Materiality determined: —
Notification sent: May 7, 2019
Affected individuals: 11state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Promptly removed the malicious code from its website
Notified law enforcement
Notified two separate forensic security firms to investigate and confirm the security of its website and other online systems
Took steps to alert the credit card brands so that they can be on the lookout for fraudulent activity
Instituted additional security controls and procedures to prevent this type of incident from happening in the future
Changes made: Instituted additional security controls and procedures to prevent this type of incident from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 7 · first

Montana State AGMay 7 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/simon-pearce-20190508.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2019
Raw hash: 05d75c24ddb6ae908642933a74f07a10eb6f442131a9620db5f0938603f49525

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPolsinelli PC

Victim entitySimon Pearce Inc

Incidentdiscovered Mar 28, 2019

Stated responsePromptly removed the malicious code from its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov