HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Creative Banner Assemblies

bd_9de11e2445bd30eb · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 22, 2013

Filed

Aug 13, 2013

To disclose

22 days

Affected

232

Confidence

66%

Full breach record for Creative Banner Assemblies →

Sign-Zone, Inc (d/b/a Creative Banner Assemblies) notified the NH Attorney General on Aug 13, 2013, of a breach affecting 232 consumers. Unauthorized access via malicious code on the website between June 1 and July 22, 2013, exposed names, addresses, phone numbers, and unencrypted credit card info with security codes. The company removed the code, enhanced security, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 22 days

Jun 1, 2013

Begins

Jul 22, 2013

Discovered

Aug 13, 2013

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed232 affectedView incident

Name: Sign-Zone, Inc
norm: sign zone

Name: Creative Banner Assemblies
norm: creative banner assemblies
Industry: Retail & Consumerllm

Discovered: Jul 22, 2013
Breach occurred: Jun 1, 2013
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 13, 2013
Affected individuals: 232state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Removing the malicious code
Modifying relevant procedures and processes on our website
Working with the appropriate authorities
Conducting a review of our own internal security and training
Implementing additional security procedures
Offering a free one year subscription to ITAC Sentinel Plus
Changes made: Removing the malicious code
Modifying relevant procedures and processes on our website
Implementing additional security procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/creative-banner-20130813.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 13, 2013
Raw hash: 72e8f0a5c372a6572e43b048144e44fd854af53c088bceafbb95326ae27fa75c

Reporting entitySign-Zone, Inc

Victim entityCreative Banner Assemblies

Incidentdiscovered Jul 22, 2013

Stated responseRemoving the malicious code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov