HackingRetail & ConsumerRetailCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Handi Quilter

bd_82183217f88906ff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2023

Filed

Aug 31, 2023

To disclose

21 days

Affected · nationwide

1182 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Handi Quilter →2 incidents on file

Handi Quilter, Inc. reported an external system breach (hacking) occurring on June 16, 2023, discovered on August 10, 2023. The incident affected 118 individuals, including 2 Maine residents. The attacker acquired names and Social Security Numbers. Handi Quilter notified consumers in writing on August 31, 2023, and provided 12 months of credit monitoring and identity protection services through IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d21 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 55 days

discovery → filing · 21 days

Jun 16, 2023

Begins

Aug 10, 2023

Discovered

Aug 31, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 35 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_376d3d705ac0d0732023-07-27 · +35dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_db9ad47afa81419d2023-08-31Verified
Massachusetts State AGbd_af1ff641a6638f582023-09-01 · +1dVerified

Name: Handi Quilter
norm: handi quilter
Domain: handiquilter.com

Name: Handi Quilter
norm: handi quilter
Domain: handiquilter.com
Industry: Retail & Consumerllm

Discovered: Aug 10, 2023
Breach occurred: Jun 16, 2023
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2023
Affected individuals: 118state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General's Office
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Offered 12 months of credit monitoring and identity protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: Leak >30dME AG ≤30d · 21d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 10, 2023
→ Filed with AG: Aug 31, 2023
21d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 10, 2023 → Filed with AG: Aug 31, 2023	21d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGAug 31 · first

Maine State AGAug 31 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/20ee600a-f6bf-466d-b5ac-de439a598a1c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2023
Raw hash: d2ee126725125539a6bd719dc12c08cf34fcb9ca34fcfdcc1e4644da1e2cb0e6

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityHandi Quilter

Victim entityHandi Quilter

Incidentdiscovered Aug 10, 2023

Stated responseSent written notification to affected consumers

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov