HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Sierra Nevada Brewing Company

bd_95659e5871aaf159 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 7, 2018

Filed

Aug 27, 2018

To disclose

20 days

Affected

4state residents only

Linked

2 filings

Confidence

67%

Full breach record for Sierra Nevada Brewing Company →

Sierra Nevada Brewing Co. notified the New Hampshire Attorney General of a security event involving its e-commerce platform (sierranevadagiftshop.com). Magento, the platform provider, identified a vulnerability allowing an unauthorized person to install malicious code to monitor form entries. The incident potentially affected 4 New Hampshire residents, exposing names, addresses, emails, credit card numbers, CVV2s, and usernames/passwords. Sierra Nevada took the site offline, engaged forensic counsel, and sent notices to affected residents on August 28, 2018, offering one year of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 days

Aug 7, 2018

Discovered

Aug 27, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_fd419cebed8e5c0a2018-08-28 · +1dCandidate

Name: McDermott Will & Emery LLP
norm: mcdermott will emery

Name: Sierra Nevada Brewing Company
norm: sierra nevada brewing
Industry: Retail & Consumerllm

Discovered: Aug 7, 2018
Materiality determined: —
Notification sent: Aug 28, 2018
Affected individuals: 4state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took the affected webpage offline
Commenced an investigation under privilege
Shut down its online payment page
Changed certain administrative passwords
Removed the code that had been inserted by the unauthorized person
Conducted a system review to identify vulnerabilities in the website
Changes made: Strengthened its systems and safeguards to prevent unauthorized persons from gaining access to its systems
Took other steps to try to prevent similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 27 · first · this page

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sierra-nevada-brewing-20180827.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2018
Raw hash: 946ba1ddd89745ef5194aaac46d8fdef88857b4f48df9a353de30f8c81cce36e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMcDermott Will & Emery LLP

Victim entitySierra Nevada Brewing Company

Incidentdiscovered Aug 7, 2018

Stated responseTook the affected webpage offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov