HackingRetail & ConsumerRetailSQL InjectionData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

The Image Group

bd_749870879e56db2f · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2008

Filed

Sep 29, 2008

To disclose

8 weeks

Affected

37state residents only

Confidence

66%

Full breach record for The Image Group →2 incidents on file

The Image Group of Toledo, Inc. notified the New Hampshire Attorney General of a security breach affecting 37 state residents. From January to August 2008, hackers exploited an SQL injection vulnerability on the company's e-commerce site to access customer names and credit/debit card information (including CVV). The company shut down the site, conducted a forensic audit, and implemented security measures. Notices were sent to affected individuals on October 6, 2008.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 213 days

discovery → filing · 8 weeks / 59 days

Jan 1, 2008

Begins

Aug 1, 2008

Discovered

Sep 29, 2008

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed37 affectedView incident

Name: The Image Group
norm: the image
Domain: theimagegroup.espwebsite.com

Name: The Image Group
norm: the image
Domain: theimagegroup.espwebsite.com
Industry: Retail & Consumerllm

Discovered: Aug 1, 2008
Breach occurred: Jan 1, 2008 – Aug 1, 2008
Undetected for: 213 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2008
Affected individuals: 37state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Shut down the web site through which the unauthorized access occurred
Had a forensic audit performed
Commenced or concluded the remedial actions suggested within the audit
Working with merchant bank and the Card Associations to address issues associated with the credit card information taken
Notified the issuing banks for those cards
Changes made: Implemented measures to secure our systems based on the recommendations of outside experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/image-group-20080929.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2008
Raw hash: df527e27c674d8aef1b125542ca6796779b7deae64dae1057cedd79137ef2c2d

Reporting entityThe Image Group

Victim entityThe Image Group

Incidentdiscovered Aug 1, 2008

Stated responseShut down the web site through which the unauthorized access occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov