HackingRetail & ConsumerTechnologyRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

TradeMotion

bd_8c236218146c5d06 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 20, 2018

Filed

Jul 24, 2018

To disclose

18 weeks

Affected

426state residents only

Linked

7 filings

Confidence

66%

Full breach record for TradeMotion →

TradeMotion, LLC notified NH DOJ of a breach affecting 426 NH residents. Unauthorized access occurred between Oct 2017 and May 2018 via compromised credentials and a technical vulnerability. Data exposed included names, addresses, emails, phone numbers, and full credit card details (including CVV). TradeMotion reset passwords, deactivated accounts, and offered 1 year of LifeLock identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 170 days

discovery → filing · 18 weeks / 126 days

Oct 1, 2017

Begins

Mar 20, 2018

Discovered

Jul 24, 2018

Filed

vs. sector median

+10 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_6ca2d644b949b91b2018-07-25 · +1dVerified
California State AGbd_8cadac9ae90af58f2018-07-25 · +1dVerified
Montana State AGbd_9e989badeef936172018-07-25 · +1dCandidate
Oregon State AGbd_bb5f8841d8f2c4a82018-07-25 · +1dVerified by operator

Show 2 more filings ↓up to 6d gap

Washington State AGbd_d50bce35ca137fd02018-07-25 · +1dVerified
South Carolina State AGbd_b2930eee6e889a432018-07-30 · +6dVerified

Name: TradeMotion
norm: trademotion
Domain: trademotion.app

Name: TradeMotion
norm: trademotion
Domain: trademotion.app
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Mar 20, 2018
Breach occurred: Oct 1, 2017 – May 31, 2018
Undetected for: 170 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 24, 2018
Affected individuals: 426state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took steps to block further unauthorized access
Enhanced existing network and email security
Deactivated unused accounts
Reset certain passwords
Minimized access to personal information
Began mailing notifications to affected individuals
Offered one year of free identity protection services through LifeLock
Changes made: Re-engineering the process in which payment information is collected and stored
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(126 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGJul 24 · first · this page

Massachusetts State AG+1d

California State AG+1d

Montana State AG+1d

Oregon State AG+1d

Washington State AG+1d

South Carolina State AG+6d

Pattern: first filing Jul 24 (NH), last Jul 30 (SC) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/trademotion-20180724.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 24, 2018
Raw hash: b50eb12aaa775b5aa228eade9e50552e949957da0eb4794bbb5a5c43a7d23a09

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTradeMotion

Victim entityTradeMotion

Incidentdiscovered Mar 20, 2018

Stated responseTook steps to block further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov