HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountLowContained

Myron Corp.

bd_9fc99454da68a8c9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 15, 2020

Filed

Jun 5, 2020

To disclose

7 weeks

Affected

70state residents only

Linked

4 filings

Confidence

66%

Full breach record for Myron Corp. →3 incidents on file

Myron Corp. d/b/a Pen Factory notified the New Hampshire Attorney General of a data security incident affecting 70 NH residents. Malicious code was placed on penfactory.com between September 2019 and April 15, 2020, capturing checkout data (names, emails, addresses, credit/debit card info). The code was removed on April 15, 2020, and notifications were sent on June 5, 2020. No SSNs were impacted. Remediation included platform upgrades and antivirus deployment.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 227 days

discovery → filing · 7 weeks / 51 days

Sep 1, 2019

Begins

Apr 15, 2020

Discovered

Jun 5, 2020

Filed

vs. sector median

on median

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_12b5b741d11e7e152020-06-05Verified
Montana State AGbd_48b2b81197880b762020-06-05Candidate
California State AGbd_5f68a92ee8ca1c892020-06-05Verified

Name: Myron Corp.
norm: myron
Domain: penfactory.com

Name: Myron Corp.
norm: myron
Domain: penfactory.com
Also named: Myron Corp.dba oflegal entity
Pen Factorydba oftrade name
Industry: Retail & Consumerllm

Discovered: Apr 15, 2020
Breach occurred: Sep 1, 2019 – Apr 15, 2020
Undetected for: 227 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 5, 2020
Affected individuals: 70state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Removed the malicious code from its website
Conducted an investigation to identify the capability of that code
Identified the individuals whose information was entered on the website during the at-risk window
Notifying impacted individuals
Changes made: Implemented steps to strengthen its website security
Upgrading its e-commerce platform
Deploying the latest antivirus software to all of its servers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 5 · first

Montana State AGJun 5 · first

California State AGJun 5 · first

New Hampshire State AGJun 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/myron-dba-pen-factory-20200605.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2020
Raw hash: ab2b8e5e27eb0aad9820bd960c0581b8d2cc6caf5fffdc017bee26da8c5f294e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMyron Corp.

Victim entityMyron Corp.

Incidentdiscovered Apr 15, 2020

Stated responseRemoved the malicious code from its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov