HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Hourglass Cosmetics

bd_9f02648a5c413aea · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 19, 2019

To disclose

—

Affected

44state residents only

Linked

4 filings

Confidence

67%

Full breach record for Hourglass Cosmetics →

Hourglass Cosmetics notified New Hampshire AG of a data breach affecting 44 residents. Unauthorized third parties accessed customer data (names, addresses, credit card numbers, CCVs) from July 3, 2018 to January 30, 2019 via unauthorized access to the e-commerce checkout process. The company engaged forensic experts, removed malicious code, and notified law enforcement and its payment processor.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 3, 2018

Begins

Feb 19, 2019

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_050d9cf9e797c1e92019-02-15 · +4dCandidate
Massachusetts State AGbd_5c545b75f99903c32019-02-15 · +4dVerified
Montana State AGbd_9a3e55599bc1edf22019-02-15 · +4dVerified

Name: Hourglass Cosmetics
norm: hourglass cosmetics
Domain: hourglasscosmetics.com

Name: Hourglass Cosmetics
norm: hourglass cosmetics
Domain: hourglasscosmetics.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jul 3, 2018 – Jan 30, 2019
Materiality determined: —
Notification sent: —
Affected individuals: 44state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Reported matter to U.S. law enforcement
Initial access: valid_credentials

During the incident: Engaged outside cybersecurity experts to assist in securing its website
Removed the code that facilitated the unauthorized scraping of data during the check-out process
Undertaken a review of patching and multiple security scans
Transitioning the Site to a new platform
Reported this matter to U.S. law enforcement
Notified its payment processor
Changes made: Reviewing security measures to identify further ways to improve security
Transitioning the Site to a new platform
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGFeb 15 · first

Massachusetts State AGFeb 15 · first

Montana State AGFeb 15 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hourglass-20190219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2019
Raw hash: a5d6083acfb3e584730edde7bab5f5106872dffcc702dce79bc3b5c9156ce088

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHourglass Cosmetics

Victim entityHourglass Cosmetics

IncidentUnauthorized Access

Stated responseEngaged outside cybersecurity experts to assist in securing its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov