HackingTransportation & LogisticsTransportationVulnerability ExploitCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)CredentialsLowContained

Park'N Fly

bd_7144a72e29ab0475 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2014

Filed

Jan 20, 2015

To disclose

20 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for Park'N Fly →4 incidents on file

Park ‘N Fly notified the NH Attorney General of a data security event involving its e-commerce website. In September 2014, the company noticed an escalation in fraud-related claims and engaged third-party forensics experts. The investigation confirmed the ecommerce site was infiltrated by an unauthorized third party, compromising payment card data (card number, name, billing address, expiration, CVV) and loyalty customer data (email, passwords, phone numbers). The compromise has been contained, but the investigation is ongoing. Park ‘N Fly began notifying the public via press release and website on January 13, 2015, and offered 12 months of identity monitoring. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 weeks / 141 days

Sep 1, 2014

Discovered

Jan 20, 2015

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1b081412af8a20872015-01-20Verified
South Carolina State AGbd_408c80d823e386892015-01-20Verified
California State AGbd_2cb24641f81286312015-01-13 · +7dCandidate
New Hampshire State AGbd_02bdd2aa4b18807d2014-12-30 · +21dCandidate

Name: Park ‘N Fly
norm: park n fly
Domain: pnf.com

Name: Park'N Fly
norm: park n fly
Domain: parknfly.ca
Industry: Transportation & Logisticsllm

Discovered: Sep 1, 2014
Materiality determined: —
Notification sent: Jan 13, 2015
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Provided preliminary notice to New Hampshire Attorney General on December 30, 2014Provided update notice to New Hampshire Attorney General on January 20, 2015
Initial access: exploit_public_facing

During the incident: Engaged independent third-party forensics experts
Took steps to identify potential vulnerabilities with its systems
Remediate and enhance the security of its systems
Contacted the vendor that maintains its server requesting maintenance on the server and site
Stopped collecting credit/debit card data through its reservation website
Established a toll-free call center to answer customer questions
Offering identity monitoring and identity protection services to potentially affected customers, free of charge for the next 12 months
Established an informational Web page for customers
Working with law enforcement and credit card brands
Changes made: Remediate and enhance the security of its systems
Contacted the vendor that maintains its server requesting maintenance on the server and site
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(141 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

New Hampshire State AGDec 30 · first

California State AG+14d

Massachusetts State AG+21d

South Carolina State AG+21d

New Hampshire State AG+21d · this page

Pattern: first filing Dec 30 (NH), last Jan 20 (NH) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/park-n-fly-20150120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2015
Raw hash: 21c64e1b0d1c1dcd7c9185404b1c17a5060e8d2e6fbd98b1b55b159c26a0e4f4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPark ‘N Fly

Victim entityPark'N Fly

Incidentdiscovered Sep 1, 2014

Stated responseEngaged independent third-party forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov