HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Aeroflow Inc.

bd_7f1388e5eb3d757a · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 20, 2019

Filed

May 20, 2019

To disclose

9 weeks

Affected

30state residents only

Linked

4 filings

Confidence

66%

Full breach record for Aeroflow Inc. →2 incidents on file

Aeroflow Inc. notified the NH Attorney General of a payment card skimming incident affecting 30 NH residents. Unauthorized code was injected into the checkout page of cheapcpapsupplies.com between Sept 7, 2018 and March 27, 2019, capturing PII and payment data. Aeroflow engaged forensic investigators and enhanced security monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 194 days

discovery → filing · 9 weeks / 61 days

Sep 7, 2018

Begins

Mar 20, 2019

Discovered

May 20, 2019

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_70d3dac0694535f32019-05-17 · +3dVerified
Massachusetts State AGbd_a8dd378297c491662019-05-17 · +3dVerified
HHS OCRbd_abad8947e923d13d2019-05-16 · +4dVerified

Name: Aeroflow Inc.
norm: aeroflow
Domain: cheapcpapsupplies.com

Name: Aeroflow Inc.
norm: aeroflow
Domain: cheapcpapsupplies.com
Industry: Retail & Consumerllm

Discovered: Mar 20, 2019
Breach occurred: Sep 7, 2018 – Mar 27, 2019
Undetected for: 194 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 17, 2019
Affected individuals: 30state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a forensic firm to assist in the investigation
Established a dedicated call center to answer questions
Took aggressive steps to address website security
Enhanced system monitoring
Changes made: Address website security
Enhance system monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRMay 16 · first

Montana State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aeroflow-20190520.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2019
Raw hash: 961b0da022dff93e5fdbb6a27139008cb7533466856ce8ebfdfac6bd76a53644

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAeroflow Inc.

Victim entityAeroflow Inc.

Incidentdiscovered Mar 20, 2019

Stated responseEngaged a forensic firm to assist in the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov