HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Ellison Systems, Inc. d.b.a. Shoplet.com

bd_751f4d8802b14516 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 11, 2013

Filed

Apr 2, 2013

To disclose

12 weeks

Affected

701state residents only

Linked

2 filings

Confidence

68%

Full breach record for Ellison Systems, Inc. d.b.a. Shoplet.com →2 incidents on file

Ellison Systems, Inc. d.b.a. Shoplet.com notified the NH Attorney General of a security incident discovered on Jan 11, 2013, where a hacker accessed customer names, addresses, and credit card info. Approximately 701 NH residents were affected. Shoplet engaged forensic investigators, installed firewalls, and notified law enforcement and affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 81 days

Jan 11, 2013

Discovered

Apr 2, 2013

Filed

vs. sector median

+4 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_005669d65e436b522013-04-08 · +6dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Ellison Systems, Inc. d.b.a. Shoplet.com
norm: ellison systems inc dba shopletcom
Domain: shoplet.com
Also named: Ellison Systems, Inc.dba oflegal entity
Shoplet.comdba oftrade name
Industry: Retail & Consumerllm

Discovered: Jan 11, 2013
Materiality determined: —
Notification sent: —
Affected individuals: 701state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notification has been provided to the Consumer Reporting Agencies
Initial access: exploit_public_facing

During the incident: Hired a computer forensic investigator to determine what happened
Installed a hardware firewall
Moved its database server to a more secure zone
Communicating with the credit card brands regarding the incident
Notified the impacted individuals
Recommended that they contact their banks and credit card companies
Law enforcement has also been notified
Changes made: Implemented increased security controls to prevent this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 2 · first · this page

Massachusetts State AG+6d

Pattern: first filing Apr 2 (NH), last Apr 8 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shoplet-20130402.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2013
Raw hash: e8b6be5e41367546ea9e44de754f9391be4a39690c3293066f86fa3061e94b7e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityEllison Systems, Inc. d.b.a. Shoplet.com

Incidentdiscovered Jan 11, 2013

Stated responseHired a computer forensic investigator to determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov