HackingRetail & ConsumerRetailVulnerability ExploitBackdoor / C2Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Mattress Insider, LLC

bd_7537583e56f5b368 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 14, 2020

Filed

Jun 25, 2020

To disclose

6 weeks

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Mattress Insider, LLC →

Mattress Insider, LLC notified the NH AG of a security breach where an unauthorized entity injected a malicious script into the payment gateway at mattressinsider.com. Unauthorized access to payment card data and personal info occurred from Jan 11, 2020 to May 14, 2020. 7 NH residents affected. Data included names, addresses, and payment card details. Response included removing code, changing credentials, engaging FBI/IC3, and offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 124 days

discovery → filing · 6 weeks / 42 days

Jan 11, 2020

Begins

May 14, 2020

Discovered

Jun 25, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_c40c90b2b0b8814f2020-06-22 · +3dVerified
Indiana State AGbd_362ca1f52d052a302020-06-15 · +10dVerified

Name: Mattress Insider, LLC
norm: mattress insider

Name: Mattress Insider, LLC
norm: mattress insider
Industry: Retail & Consumerllm

Discovered: May 14, 2020
Breach occurred: Jan 11, 2020 – May 14, 2020
Undetected for: 124 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2020
Affected individuals: 7state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralReported incident to FBIFiled complaint with Internet Crime Complaint Center (IC3)Contacted Jefferson County Sheriff's department
Initial access: exploit_public_facing

During the incident: Identified and removed the extra code that was added to the compromised files
Searched server logs to identify additional threats
Changed payment gateway and check out module credentials for all staff
Added additional monitoring to systems
Terminated business relationship with payment gateway developers
Completed migration to another payment gateway provider
Reported the incident to the FBI
Filed a complaint with Internet Crime Complaint Center (IC3)
Contacted the Jefferson County Sheriff's department
Changes made: Offering twelve months of complimentary credit monitoring with fraud alert and identity theft protection services/insurance through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 15 · first

Massachusetts State AG+7d

New Hampshire State AG+10d · this page

Pattern: first filing Jun 15 (IN), last Jun 25 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mattress-insider-20200625.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2020
Raw hash: 50606ed1d231d16da8d444fda7e9a7c6c965ebb8ba9048228938dfe7510b3b90

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMattress Insider, LLC

Victim entityMattress Insider, LLC

Incidentdiscovered May 14, 2020

Stated responseIdentified and removed the extra code that was added to the compromised files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov