HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountCredentialsIdentity (basic)LowContained

Freedom Management Group, LLC

bd_815dc8b1b9af3a61 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 15, 2014

Filed

Aug 19, 2014

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Freedom Management Group, LLC →

Freedom Management Group (dba The Natural) disclosed a breach affecting TheNaturalOnline.com where unauthorized access occurred between April 22 and July 17, 2014. The incident compromised customer payment card data, CVVs, and personal information. The company engaged forensic investigators, closed the access point, removed malware, and notified financial institutions. Affected individuals received 12 months of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 84 days

discovery → filing · 5 weeks / 35 days

Apr 22, 2014

Begins

Jul 15, 2014

Discovered

Aug 19, 2014

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_44a168344fd756552014-08-20 · +1dVerified
California State AGbd_63ca626a9e0beaf02014-08-12 · +7dCandidate

Name: Freedom Management Group, LLC
norm: freedom management
Domain: thenaturalonline.com

Name: Freedom Management Group, LLC
norm: freedom management
Domain: thenaturalonline.com
Also named: Freedom Management Group, LLCdba oflegal entity
The Naturaldba oftrade name
Industry: Retail & Consumerllm

Discovered: Jul 15, 2014
Breach occurred: Apr 22, 2014 – Jul 17, 2014
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2014
Affected individuals: Not disclosed
Data types: Financial accountCredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: The Natural notified the necessary credit card companies, credit bureaus and attorney generals
Initial access: exploit_public_facing

During the incident: Started a forensic investigation
Closed the access point that the criminals used
Removed the malware they left behind
Alerted financial institutions immediately after confirming the unauthorized access
Arranged to have AllClear ID protect your identity for 12 months
Changes made: Implemented additional security measures and procedures to reduce the likelihood that this ever happens again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGAug 12 · first

New Hampshire State AG+7d · this page

Massachusetts State AG+8d

Pattern: first filing Aug 12 (CA), last Aug 20 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/freedom-management-natural-20140819.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 19, 2014
Raw hash: 0e261b397534579fc84a4290e45696d7d387028bd30656954128e54d27a4de66

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFreedom Management Group, LLC

Victim entityFreedom Management Group, LLC

Incidentdiscovered Jul 15, 2014

Stated responseStarted a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov