DisclosureLens
MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountMediumContained

Plow and Hearth, LLC

bd_6e0712cdfba6e050 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2016

Filed

Feb 25, 2017

To disclose

16 weeks

Affected

1,274state residents only

Linked

4 filings

Confidence

68%
Full breach record for Plow and Hearth, LLC →3 incidents on file

Plow and Hearth, LLC reported a cybersecurity incident to the Washington Attorney General. A third-party platform provider, Aptos, experienced a malware intrusion between February 2016 and December 2016. The incident affected 1,274 Washington residents, exposing names, addresses, phone numbers, and payment card data. Aptos engaged forensic investigators and notified law enforcement.

Incident timeline

undetected · 254 days
discovery → filing · 16 weeks / 111 days

Feb 26, 2016

Begins

Nov 6, 2016

Discovered

Feb 25, 2017

Filed

vs. sector median

+8 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Washington State AGFeb 25 · first · this page
Oregon State AG+13d
Montana State AG+17d
Hawaii State AG+45d

Pattern: first filing Feb 25 (WA), last Apr 11 (HI) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.