HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowContained

ECS Tuning, Inc.

bd_7a8fc6b1cbf64136 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 19, 2012

To disclose

—

Affected

71state residents only

Linked

2 filings

Confidence

66%

Full breach record for ECS Tuning, Inc. →2 incidents on file

ECS Tuning, Inc. notified the NH Attorney General of a security breach occurring between May 6-10, 2012. An unauthorized third party accessed customer PII including names, addresses, passwords, and credit card details. 71 NH residents were affected. ECS secured the access method, notified credit card issuers, filed a police report, and sent customer notifications on June 15, 2012. Remediation included integrating PayPal Payflow Pro and removing stored card data.

J jump to incidentP pin to compareR raw source

Incident timeline

May 6, 2012

Begins

Jun 19, 2012

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_f41621f315fbc4952012-06-19Candidate

Name: ECS Tuning, Inc.
norm: ecs tuning
Domain: ecstuning.com

Name: ECS Tuning, Inc.
norm: ecs tuning
Domain: ecstuning.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 6, 2012 – May 10, 2012
Materiality determined: —
Notification sent: Jun 15, 2012
Affected individuals: 71state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Identified and secured the method of unauthorized access
Notified the credit card companies
Filed a case with the local Wadsworth, Ohio Police Department (Case# 21205162) and are cooperating with their investigation
Sent notification letters to affected customers
Changes made: Integrated PayPal’s Payflow Pro to add additional security to the ECS Tuning checkout process
Removed the storage of credit and debit cards for any length of time regardless of order status
Added extra layers of security to ensure our customer privacy, such as scanning all inbound and outbound traffic
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGJun 19 · first

New Hampshire State AGJun 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ecs-tuning-20120619.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 19, 2012
Raw hash: f59bb592b8d7bdf403b38e789a9d94a151e48b0c2deeb0aff22ae7912c66332b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityECS Tuning, Inc.

Victim entityECS Tuning, Inc.

IncidentUnauthorized Access

Stated responseIdentified and secured the method of unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov