HackingRetail & ConsumerTechnologyRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

Mannix Marketing

bd_72f8e3dfaf2738bb · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 20, 2013

Filed

Dec 12, 2013

To disclose

22 days

Affected

Not disclosed

Confidence

66%

Full breach record for Mannix Marketing →

Mannix Marketing notified the NH AG that an unauthorized person gained access to its servers on Nov 20, 2013, compromising customer data (names, addresses, credit card numbers, CCVs) for four clients. Mannix terminated access, removed malicious code, engaged forensic IT professionals, and retained AllClear ID for identity monitoring. Notices were mailed around Dec 13, 2013.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Nov 20, 2013

Discovered

Dec 12, 2013

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mannix Marketing
norm: mannix marketing

Name: Mannix Marketing
norm: mannix marketing
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Nov 20, 2013
Materiality determined: —
Notification sent: Dec 13, 2013
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General (New Hampshire)In communication with other regulatory agencies
Initial access: exploit_public_facing

During the incident: Removed the malicious code from its servers
Terminated the hacker’s access
Contracted with IT security professionals to analyze the breach
Contracted with AllClear ID to provide identity monitoring and restoration services
Notified the four clients
Contacted other regulatory agencies
Changes made: Removed the malicious code from its servers
Terminated the hacker’s access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mannix-marketing-20131212.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2013
Raw hash: edf4a5c2954dbd3921c130c30b5a44163d33915215b48b127c188c40117b4fac

Reporting entityMannix Marketing

Victim entityMannix Marketing

Incidentdiscovered Nov 20, 2013

Stated responseRemoved the malicious code from its servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov