HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Easy Breathe, Inc.

bd_9a18ddc515f7c191 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2017

Filed

Mar 27, 2017

To disclose

6 weeks

Affected

330state residents only

Linked

6 filings

Confidence

67%

Full breach record for Easy Breathe, Inc. →

Easy Breathe, Inc. notified the NH Attorney General of a potential data security incident discovered on Feb 10, 2017. An unknown individual may have accessed customer payment card info (name, address, phone, card details) from its online store. 330 NH residents were affected. Notifications were mailed on March 27, 2017. The company engaged IT experts to secure the website and offered 1 year of identity repair services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Feb 10, 2017

Discovered

Mar 27, 2017

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_0ffdb705de61caaf2017-03-27Verified
Oregon State AGbd_30f914a5f01ddc412017-03-27Candidate
Massachusetts State AGbd_c6c8a59de40209412017-03-27Verified
Washington State AGbd_f6e58d89ec9258c12017-03-27Verified

Show 1 more filing ↓up to 4d gap

South Carolina State AGbd_6a25382414ceb30b2017-03-31 · +4dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Easy Breathe, Inc.
norm: easy breathe
Industry: Retail & Consumerllm

Discovered: Feb 10, 2017
Materiality determined: —
Notification sent: Mar 27, 2017
Affected individuals: 330state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged IT experts who have assisted Easy Breathe in securing its website
Addressed possible vulnerabilities
Implemented continuous security monitoring of its website
Offering potentially impacted individuals identity repair services for one year, at no cost to the individual through AllClear ID
Notice has also been provided to the credit reporting agencies
Changes made: Secured its website
Addressed possible vulnerabilities
Implemented continuous security monitoring of its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGMar 27 · first

Oregon State AGMar 27 · first

Massachusetts State AGMar 27 · first

Washington State AGMar 27 · first

New Hampshire State AGMar 27 · first · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/easy-breathe-20170327.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2017
Raw hash: 1d48f55394d3607fc18009b9cb021959c397e0d0b42aa6180a3e7f4ccd0252fa

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityEasy Breathe, Inc.

Incidentdiscovered Feb 10, 2017

Stated responseEngaged IT experts who have assisted Easy Breathe in securing its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov