HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedPCIFinancial accountFinancial credentialsLowContained

PAX Labs, Inc.

bd_8bd1ff1a24c029ad · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 15, 2016

Filed

Aug 11, 2016

To disclose

27 days

Affected

24state residents only

Linked

4 filings

Confidence

66%

Full breach record for PAX Labs, Inc. →

PAX Labs, Inc. notified the New Hampshire Attorney General of a security incident where an unauthorized party gained access to a cloud-based website server between June 25 and July 22, 2016. The attacker installed unauthorized software to access payment card data (names, card numbers, CVV) of approximately 24 New Hampshire residents. PAX engaged forensic investigators, notified processors and law enforcement, and implemented enhanced firewall and monitoring rules. Affected residents were offered 12 months of credit monitoring and identity theft insurance.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 20 days

discovery → filing · 27 days

Jun 25, 2016

Begins

Jul 15, 2016

Discovered

Aug 11, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_a1430bc57e4c62122016-08-11Verified
California State AGbd_ae35c365847dec6d2016-08-12 · +1dVerified
Montana State AGbd_cdfab40ab9f0cea12016-08-12 · +1dCandidate

Name: PAX Labs, Inc.
norm: pax labs

Name: PAX Labs, Inc.
norm: pax labs
Industry: Retail & Consumerllm

Discovered: Jul 15, 2016
Breach occurred: Jun 25, 2016 – Jul 22, 2016
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2016
Affected individuals: 24state-resident count only
Data types: PCIFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: informed federal law enforcement authorities
Initial access: exploit_public_facing

During the incident: Engaged a computer forensics and cybersecurity team to investigate the breach and restore the integrity of its system
Notified affected payment card processors
Informed federal law enforcement authorities
Implemented additional security measures, including more aggressive firewall rules and detailed system monitoring tools
Engaged Al1Clear ID, Inc. to provide 12 months of free credit monitoring, identity theft investigation and repair, and $1M of identity theft insurance coverage to affected New Hampshire residents
Changes made: Implemented more aggressive firewall rules
Implemented detailed system monitoring tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 11 · first

New Hampshire State AGAug 11 · first · this page

California State AG+1d

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pax-labs-20160811.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 11, 2016
Raw hash: 8c9030ad38311fcffaa7712a0cf283b23875cee7f5217ef0609016c21ca4220b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPAX Labs, Inc.

Victim entityPAX Labs, Inc.

Incidentdiscovered Jul 15, 2016

Stated responseEngaged a computer forensics and cybersecurity team to investigate the breach and restore the integrity of its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov