HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)PIILowContained

National Association of Music Merchants

bd_7e9aa0b973934e3d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2023

Filed

Jul 18, 2023

To disclose

5 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for National Association of Music Merchants →

National Association of Music Merchants (NAMM) notified the New Hampshire Attorney General of unauthorized network access occurring between Dec 2-16, 2022. Investigation concluded June 14, 2023, revealing PII of one NH resident was removed. NAMM contained the threat, engaged forensic counsel, and offered credit monitoring to the affected individual.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 194 days

discovery → filing · 5 weeks / 34 days

Dec 2, 2022

Begins

Jun 14, 2023

Discovered

Jul 18, 2023

Filed

vs. sector median

14 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_21025386c33ae2022023-07-14 · +4dVerified
Massachusetts State AGbd_aceb7fe69e2b8cf02023-07-14 · +4dVerified

Name: National Association of Music Merchants
norm: national association of music merchants

Name: National Association of Music Merchants
norm: national association of music merchants
Industry: Professional Servicesllm

Discovered: Jun 14, 2023
Breach occurred: Dec 2, 2022 – Dec 16, 2022
Undetected for: 194 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 14, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Contained and secured the threat
Launched an investigation in consultation with outside cybersecurity professionals
Providing the affected resident with written notification
Offering resident complimentary membership with a credit monitoring service
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJul 14 · first

Massachusetts State AGJul 14 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-association-music-merchants-20230718.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2023
Raw hash: 41f542c7a56fde543ac89bc051c72986b1c0fa2c5a4731e40a4d86414b81267f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNational Association of Music Merchants

Victim entityNational Association of Music Merchants

Incidentdiscovered Jun 14, 2023

Stated responseContained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov