HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryAuthenticationCredentialsFinancial accountIdentity (basic)MediumContained

North 40 Outfitters

bd_91ec3d5509abff2e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 8, 2018

Filed

Feb 14, 2019

To disclose

14 weeks

Affected · nationwide

2,632315 in this filing

Linked

7 filings

Confidence

68%

Full breach record for North 40 Outfitters →3 incidents on file

North 40 Outfitters reported a cybersecurity incident where an intruder introduced a program on its webserver to capture customer credit/debit card data and credentials. The breach affected transactions from Feb 2, 2018, to Jan 22, 2019. 2,632 individuals were affected, including 315 Washington residents. Notices were sent in Feb 2019, with a supplemental notice in April 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 279 days

discovery → filing · 14 weeks / 98 days

Feb 2, 2018

Begins

Nov 8, 2018

Discovered

Feb 14, 2019

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_4b668a3582761b702019-02-14Candidate
Oregon State AGbd_9f6005ba312469512019-02-14Verified
Massachusetts State AGbd_b52d773a93fb37ee2019-02-14Verified
California State AGbd_e64ead328d32d9722019-02-14Verified

Show 2 more filings ↓up to 74d gap

New Hampshire State AGbd_c382d77b4fab019c2019-02-19 · +5dVerified
New Hampshire State AGbd_413daf193a69e1642019-04-29 · +74dVerified

Name: North 40 Outfitters
norm: north 40 outfitters

Name: North 40 Outfitters
norm: north 40 outfitters
Industry: Retail & Consumerllm

Discovered: Nov 8, 2018
Breach occurred: Feb 2, 2018 – Jan 22, 2019
Undetected for: 279 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2019
Affected individuals: 2,632state + nationwide
Data types: Identity (basic)Financial accountCredentials
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 200-299d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: provided notice to your office on February 14, 2019providing written notice of this incident to other state regulators and the consumer reporting agencies
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a third-party forensic firm
Successfully blocked further unauthorized access
Provided notice of the incident to the affected individuals
Reported this incident to the credit card companies
Changes made: Working to implement additional safeguards and training to its employees
Continues to monitor its e-commerce environment to guard against suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Montana State AGFeb 14 · first

Oregon State AGFeb 14 · first

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first

Washington State AGFeb 14 · first · this page

New Hampshire State AG+5d

New Hampshire State AG+74d

Pattern: first filing Feb 14 (MT), last Apr 29 (NH) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2019
Raw hash: 7fa4db7d0e5a947da4b0289ca3e6b899d69c59452f4a4075e8b7be493ecf3cdd

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorth 40 Outfitters

Victim entityNorth 40 Outfitters

Incidentdiscovered Nov 8, 2018

Stated responseLaunched an investigation with the assistance of a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com