HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowContained

Princess Polly Group Pty. Ltd.

bd_7d21581291709ebe · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 24, 2019

Filed

Jun 3, 2019

To disclose

6 weeks

Affected

334state residents only

Linked

6 filings

Confidence

66%

Full breach record for Princess Polly Group Pty. Ltd. →

Princess Polly Group PTY Ltd notified the NH AG of unauthorized access to its Australian e-commerce website between Nov 1, 2018 and Apr 29, 2019. Suspicious activity was detected on Apr 24, 2019. The incident affected 334 NH residents, exposing names, addresses, credit card details, and usernames/passwords. The company engaged external cybersecurity consultants and upgraded its payment processor.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 174 days

discovery → filing · 6 weeks / 40 days

Nov 1, 2018

Begins

Apr 24, 2019

Discovered

Jun 3, 2019

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_b0a23f6591c1325f2019-06-06 · +3dVerified by operator
Washington State AGbd_243e455eea2d8d5d2019-06-07 · +4dVerified
Massachusetts State AGbd_5ee66b78eece5a852019-06-07 · +4dVerified
California State AGbd_c7693b5f3079e6a22019-06-07 · +4dVerified

Show 1 more filing ↓up to 4d gap

Oregon State AGbd_1ff09f03b52d883e2019-05-30 · +4dCandidate

Name: Princess Polly Group Pty. Ltd.
norm: princess polly
Domain: princesspolly.com
Industry: Retail

Name: Princess Polly Group Pty. Ltd.
norm: princess polly
Domain: princesspolly.com
Industry: Retail
Industry: Retail & Consumerllm

Discovered: Apr 24, 2019
Breach occurred: Nov 1, 2018 – Apr 29, 2019
Undetected for: 174 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 30, 2019
Affected individuals: 334state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Engaged external IT and Cyber Security consultants to fully investigate this incident
Took additional security measures to further secure the website and customer payment information
Working to identify those customers whose payment information may be affected
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Upgraded credit card provider to Braintree, a PayPal owned company
Further strengthened security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGMay 30 · first

New Hampshire State AG+4d · this page

Montana State AG+7d

Washington State AG+8d

Massachusetts State AG+8d

California State AG+8d

Pattern: first filing May 30 (OR), last Jun 7 (CA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/princess-polly-20190603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2019
Raw hash: 7853d3b6a33c095ccfc1df33e0e54d09a78c1b97140fc51b5b599fa17b5255ee

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPrincess Polly Group Pty. Ltd.

Victim entityPrincess Polly Group Pty. Ltd.

Incidentdiscovered Apr 24, 2019

Stated responseEngaged external IT and Cyber Security consultants to fully investigate this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov