HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

ILKB, LLC

bd_876dd9be670197a0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2017

Filed

Apr 11, 2017

To disclose

18 days

Affected

74state residents only

Linked

6 filings

Confidence

66%

Full breach record for ILKB, LLC →

ILKB, LLC. notified the NH AG of a supplemental breach affecting 74 NH residents. Unauthorized access occurred intermittently between Oct 2016 and Jan 2017 via a web server. Data exposed: names, addresses, emails, credit/debit card info. Discovered March 24, 2017. Notifications sent April 14, 2017. Forensic experts and counsel retained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 174 days

discovery → filing · 18 days

Oct 1, 2016

Begins

Mar 24, 2017

Discovered

Apr 11, 2017

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_8911a8f39765c0df2017-04-12 · +1dCandidate
Montana State AGbd_bf45e3112af8752a2017-04-19 · +8dVerified by operator
California State AGbd_ddf52c1647e1b3b52017-04-24 · +13dVerified
Massachusetts State AGbd_3152dfb4c2bf19262017-03-08 · +34dVerified

Show 1 more filing ↓up to 36d gap

New Hampshire State AGbd_ff7512280fa21a122017-03-06 · +36dVerified

Name: ILKB, LLC
norm: ilkb

Name: ILKB, LLC
norm: ilkb
Industry: Retail & Consumerllm

Discovered: Mar 24, 2017
Breach occurred: Oct 1, 2016 – Jan 31, 2017
Undetected for: 174 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2017
Affected individuals: 74state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Retained a third-party team of forensic technical experts to assess and remediate any security concerns on our system
Retained cyber counsel to ensure notifications to consumers like you were performed in compliance with the law
Changes made: Considering moving onto a managed server system
Adding further protections to our security systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

New Hampshire State AGMar 6 · first

Massachusetts State AG+2d

New Hampshire State AG+36d · this page

Washington State AG+37d

Montana State AG+44d

California State AG+49d

Pattern: first filing Mar 6 (NH), last Apr 24 (CA) — a 49-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ilkb-20170411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2017
Raw hash: d9bcc6102f2dba156afce2863ca05df06237f469cce1360d651a3710b2e30d13

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityILKB, LLC

Victim entityILKB, LLC

Incidentdiscovered Mar 24, 2017

Stated responseRetained a third-party team of forensic technical experts to assess and remediate any security concerns on our system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov