MisuseRetail & ConsumerRetailPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Financial accountMediumContained

The Atlantic

bd_78ab89259639a9da · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 30, 2020

Filed

Jan 11, 2021

To disclose

12 days

Affected

1,681state residents only

Confidence

66%

Full breach record for The Atlantic →5 incidents on file

Atlantic Innovations, LLC (d/b/a Too Timid) notified the NH Attorney General of a data security incident involving rogue Shopify employees who accessed customer data. Affected data included names, emails, order history, and last 4 digits of credit cards. Approximately 1,681 NH residents were affected. Incident occurred around April 2020; discovered Dec 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 264 days

discovery → filing · 12 days

Apr 10, 2020

Begins

Dec 30, 2020

Discovered

Jan 11, 2021

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,681 affectedView incident

Name: Craig
norm: craig
Domain: craig.chat

Name: The Atlantic
norm: the atlantic
Domain: theatlantic.com
Industry: Retail & Consumerllm

Discovered: Dec 30, 2020
Breach occurred: Apr 10, 2020
Undetected for: 264 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2021
Affected individuals: 1,681state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Shopify has notified the appropriate federal authoritiesShopify referred the matter to law enforcement
Initial access: insider_action

During the incident: Shopify terminated the individuals’ access to Shopify's network
Shopify launched an investigation
Shopify referred the matter to law enforcement
Shopify implemented additional security measures on our platform
AI and Too Timid have examined its own safeguards to determine what improvements could be made to its data security and their e-commerce infrastructure
Changes made: Shopify implemented additional security measures on our platform
AI and Too Timid have examined its own safeguards to determine what improvements could be made to its data security and their e-commerce infrastructure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/atlantic-innovations-20210115.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2021
Raw hash: 48d254d79ae31601d261dc6574742b27f378e7692de4cf4639558e9330e54aea

Reporting entityCraig

Victim entityThe Atlantic

Incidentdiscovered Dec 30, 2020

Stated responseShopify terminated the individuals’ access to Shopify's network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov