HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumActive

Made In Oregon

bd_81dd9834f8db446b · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 22, 2021

To disclose

—

Affected · nationwide

12,89034 in this filing

Linked

7 filings

Confidence

65%

Full breach record for Made In Oregon →3 incidents on file

Made In Oregon (Naito Corporation) reported a data breach affecting up to 12,890 customers between Sept 2020 and Feb 2021. Unauthorized access likely exposed names, addresses, emails, and credit card info. 34 NH residents affected. Notification sent June 22, 2021, offering 2 years credit monitoring. Investigation ongoing; source of breach not yet identified.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 1, 2020

Begins

Jun 22, 2021

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_01d62431247fb74c2021-06-22Verified
Washington State AGbd_fb58f1d5247467d22021-06-22Verified
South Carolina State AGbd_ba30aa9f4043b8e62021-06-23 · +1dVerified
California State AGbd_7efe2ddfcbdd679b2021-06-18 · +4dVerified

Show 2 more filings ↓up to 29d gap

Montana State AGbd_780ad110f3a857772021-06-16 · +6dCandidate
Oregon State AGbd_7d61036037d4cf672021-07-21 · +29dVerified

Name: Naito Corporation
norm: naito

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 1, 2020 – Feb 28, 2021
Materiality determined: —
Notification sent: Jun 22, 2021
Affected individuals: 12,890state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed reports of the incident with the US Secret Service and FBINotified the three national credit reporting agencies
Initial access: exploit_public_facing

During the incident: Hired a forensic investigator specializing in investigating website credit card compromises
Installed monitoring software on our website
Website was under 24/7 surveillance
Modified our website in February to stop accepting customer information
Filed reports of the incident with the US Secret Service and FBI
Notified the three national credit reporting agencies
Offering all potentially affected customers in your state two years of ID fraud and credit monitoring protection from Experian at no charge
Changes made: Current site will be replaced with different software on a different website host
Deploying a completely new website using different software running at a new website hosting company
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 16 · first

California State AG+2d

Indiana State AG+6d

Washington State AG+6d

New Hampshire State AG+6d · this page

South Carolina State AG+7d

Oregon State AG+35d

Pattern: first filing Jun 16 (MT), last Jul 21 (OR) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/made-oregon-20210622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2021
Raw hash: 1d4e3cf37358275f98db544eda265a96a837bea174a074eddf8961e1aaa3bf3c

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNaito Corporation

Victim entityMade In Oregon

IncidentUnauthorized Access

Stated responseHired a forensic investigator specializing in investigating website credit card compromises

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov