HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

San Diego Hardware

bd_9e09372532c67061 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 5, 2018

Filed

Dec 5, 2018

To disclose

≤1 day

Affected

109state residents only

Linked

4 filings

Confidence

66%

Full breach record for San Diego Hardware →

San Diego Hardware notified NH DOJ of a breach affecting 109 NH residents. A malicious script on www.hardwaresource.com (Feb-Aug 2018) exfiltrated names, addresses, and credit card data. Discovered via First Data/Discover notification. FBI and state agencies notified. Forensic investigation conducted.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 303 days

discovery → filing · ≤1 day / 0 days

Feb 5, 2018

Begins

Dec 5, 2018

Discovered

Dec 5, 2018

Filed

vs. sector median

10 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_78c4e765ddd3e67a2018-12-05Candidate
Washington State AGbd_d9a6a6109905ae922018-12-05Verified
Montana State AGbd_dc54835f44a78c4d2018-12-05Verified by operator

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com

Name: San Diego Hardware
norm: san diego hardware
Domain: hardwaresource.com
Industry: Retail & Consumerllm

Discovered: Dec 5, 2018
Breach occurred: Feb 5, 2018 – Aug 21, 2018
Undetected for: 303 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2018
Affected individuals: 109state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified applicable state agencies
Initial access: exploit_public_facing

During the incident: Placed the Website into “maintenance mode”
Hired a specialized forensic IT firm to evaluate the potential data breach
Notified the FBI
Notified the applicable state agencies
Changes made: Malicious script has now been removed
Reviewing its online security policies to ensure all security measures are being taken to avoid such an incident from occurring again
Offering a suite of fraud recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGDec 5 · first

Washington State AGDec 5 · first

Montana State AGDec 5 · first

New Hampshire State AGDec 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/san-diego-hardware-20181205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 5, 2018
Raw hash: df9b5d0fbabc0deba0fb7dcd46b993e9838f6d5a470206fa1509d802b78b35ea

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Diego Hardware

Victim entitySan Diego Hardware

Incidentdiscovered Dec 5, 2018

Stated responsePlaced the Website into “maintenance mode”

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov