HackingRetail & ConsumerRetailCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)CredentialsLowContained

North 40 Outfitters

bd_9ecd23c311d8518a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 29, 2018

Filed

Feb 23, 2018

To disclose

25 days

Affected

864state residents only

Linked

6 filings

Confidence

66%

Full breach record for North 40 Outfitters →3 incidents on file

North 40 Outfitters disclosed unauthorized access to customer credit and debit card data from its e-commerce website. The incident affected transactions between January 20, 2017, and January 29, 2018. Data exposed included names, card numbers, expiration dates, CVVs, and potentially account credentials. 864 California residents were notified on February 23, 2018. The company launched an investigation, reported to credit card companies, and implemented additional safeguards.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 29, 2018 → Notified Feb 23, 201825d ✓ CA 60-day OK25 days discovery → filing

Incident timeline

undetected · 374 days

discovery → filing · 25 days

Jan 20, 2017

Begins

Jan 29, 2018

Discovered

Feb 23, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_069c13cfc48be80e2018-02-23Verified by operator
Oregon State AGbd_683500fb75bce2642018-02-23Verified
New Hampshire State AGbd_776f2a1b48b8922d2018-02-23Verified
Montana State AGbd_b10dceeda50d51cf2018-02-23Verified

Show 1 more filing ↓

Massachusetts State AGbd_b15fa94c229c56f62018-02-23Verified

Name: North 40 Outfitters
norm: north 40 outfitters

Name: North 40 Outfitters
norm: north 40 outfitters
Industry: Retail & Consumerllm

Discovered: Jan 29, 2018
Breach occurred: Jan 20, 2017 – Jan 29, 2018
Undetected for: 374 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2018
Affected individuals: 864state-resident count only
Data types: Financial accountFinancial credentialsIdentity (basic)Credentials
Attack vector: Unknown
Regulator citations: Reported this incident to the credit card companiesProviding written notice of this incident to other state regulators as necessary

During the incident: Launched an investigation to determine the nature and scope of the incident
Reported this incident to the credit card companies
Providing all impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Providing written notice of this incident to other state regulators as necessary
Changes made: Working to implement additional safeguards and training to its employees
Continues to monitor its e-commerce environment to guard against suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: CA 60-day OK · 25d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 29, 2018
→ Notified: Feb 23, 2018
25d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 29, 2018 → Notified: Feb 23, 2018	25d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGFeb 23 · first

Oregon State AGFeb 23 · first

New Hampshire State AGFeb 23 · first

Montana State AGFeb 23 · first

Massachusetts State AGFeb 23 · first

California State AGFeb 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-134036
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2018
Raw hash: ed3f68f3d582045ee48960bccd86b7ec12def92c943278f6f7caa9affdbc5d5f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNorth 40 Outfitters

Victim entityNorth 40 Outfitters

Incidentdiscovered Jan 29, 2018

Stated responseLaunched an investigation to determine the nature and scope of the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov