Social EngineeringPhishingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedMulti-Stage ChainPIIIDENTITY_BASICLowContained
Tool-Flo
bd_8920611ea4b04107 · schema v1 · pii pii-v1
Full breach record for Tool-Flo →Tool-Flo voluntarily notified the NH AG of a third-party data breach involving SignatureIT Ltd., an e-commerce platform provider. SignatureIT detected unusual activity on Nov 16, 2023, following a suspicious email (phishing) that likely led to unauthorized access. Tool-Flo notified ~2 affected residents (MD) on Dec 6, 2023. Tool-Flo's own systems were not compromised.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_305f8f2ed3e9b0c8Maine State AGfiled 2023-12-15(1d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/tool-flo-20231214.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 14, 2023
- Raw hash
- e8ee78777d0149941bec8582be00d7b908955195586250cb5312763367efb222
Reporting entity
- Name
- Tool-Flonorm: tool flo
Victim entity
- Name
- Tool-Flonorm: tool flo
Incident
- Discovered
- Nov 16, 2023
- Materiality determined
- —
- Notification sent
- Dec 6, 2023
- Affected individuals
- 2
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified the U.S. Federal Bureau of InvestigationNotified the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure ActNotified applicable U.S. state agenciesNotified the E.U. under the General Data Protection Regulation
- Third party
- via SignatureIT Ltd.
- Initial access
- phishing_link
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.