HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Intex Recreation Corp

bd_78536aea4c593a6e · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 16, 2016

Filed

Feb 22, 2017

To disclose

14 weeks

Affected

337state residents only

Linked

6 filings

Confidence

66%

Full breach record for Intex Recreation Corp →

Intex Recreation Corp. notified NH AG of a security incident where malicious code was inserted into its website between April 24 and December 14, 2016. The company discovered the compromise on November 16, 2016. Customer PII (name, address, phone, email) and credit card info were accessed. 337 NH residents affected. Notices sent Feb 23, 2017. Remediation included removing code, rebuilding site, and offering 1 year of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 206 days

discovery → filing · 14 weeks / 98 days

Apr 24, 2016

Begins

Nov 16, 2016

Discovered

Feb 22, 2017

Filed

vs. sector median

+6 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_08f0693cc43475e22017-02-22Candidate
Montana State AGbd_b7aafdc77e09730e2017-02-22Verified by operator
California State AGbd_2d452ad91e0a958f2017-02-20 · +2dVerified
Oregon State AGbd_4845dadec40ea6ff2017-02-27 · +5dVerified

Show 1 more filing ↓up to 5d gap

Massachusetts State AGbd_679019bfe2a40caf2017-02-17 · +5dVerified

Name: Intex Recreation Corp
norm: intex recreation

Name: Intex Recreation Corp
norm: intex recreation
Industry: Retail & Consumerllm

Discovered: Nov 16, 2016
Breach occurred: Apr 24, 2016 – Dec 14, 2016
Undetected for: 206 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2017
Affected individuals: 337state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation to determine the nature and scope of this event
Began working with third-party forensic investigators to assist with these efforts
Removed the malicious code
Completely rebuilt the website on a new server and added new protections
Changes made: Removed the malicious code
Completely rebuilt the website on a new server and added new protections
Providing the affected individuals with information they can use to better protect against identity theft and fraud
Access to one year of identity protection services free of charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 17 · first

California State AG+3d

Washington State AG+5d

Montana State AG+5d

New Hampshire State AG+5d · this page

Oregon State AG+10d

Pattern: first filing Feb 17 (MA), last Feb 27 (OR) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/intex-20170222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2017
Raw hash: 641bec64a564ed7c1e1188fececb03b4b1970d634fdb81f019c4e5167b9add0e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityIntex Recreation Corp

Victim entityIntex Recreation Corp

Incidentdiscovered Nov 16, 2016

Stated responseLaunched an investigation to determine the nature and scope of this event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov