HackingRetail & ConsumerRetailStolen CredentialsRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowActive

Inspired by…Inc.

bd_719683a0bf373e16 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 15, 2017

Filed

Dec 7, 2017

To disclose

16 weeks

Affected

20state residents only

Confidence

66%

Full breach record for Inspired by…Inc. →

Inspired by…Inc. (dba MFTstamps.com) notified the NH AG of a data breach affecting 20 NH residents. Unauthorized access occurred via a compromised third-party (Gorilla GEMS) admin account between June 22 and August 15, 2017. Customer PII, credit card info, and credentials were exposed. MFT engaged forensic experts, remediated the account, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 54 days

discovery → filing · 16 weeks / 114 days

Jun 22, 2017

Begins

Aug 15, 2017

Discovered

Dec 7, 2017

Filed

vs. sector median

+9 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed20 affectedView incident

Name: Inspired by…Inc.
norm: inspired by

Name: Inspired by…Inc.
norm: inspired by
Also named: Inspired by…Inc.dba oflegal entity
MFTstamps.comdba oftrade name
Industry: Retail & Consumerllm

Discovered: Aug 15, 2017
Breach occurred: Jun 22, 2017 – Aug 15, 2017
Undetected for: 54 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 11, 2017
Affected individuals: 20state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection and Antitrust Bureau
Third party: via Gorilla GEMS, Inc.
Initial access: valid_credentials

During the incident: Hired independent forensic experts to examine and access the breach
Sending a breach notification letter to its affected customers
Administrative account that was compromised has been remediated
All administrative email credentials have been changed
Malicious software has been shut down, contained and removed
Offering to pay for one year of credit monitoring service through Transunion
Changes made: Remediated compromised administrative account
Changed all administrative email credentials
Removed malicious software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(114 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/inspired-by-20171207.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 7, 2017
Raw hash: ff6b1d8ce10269f8d45af26a34e06df126d23471108e72ebf76c6895edf968cf

Reporting entityInspired by…Inc.

Victim entityInspired by…Inc.

Incidentdiscovered Aug 15, 2017

Stated responseHired independent forensic experts to examine and access the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov