HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowContained

Evolution Nature Corp.

bd_a15ab12265b1e676 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 16, 2014

Filed

Nov 7, 2014

To disclose

7 weeks

Affected · nationwide

8387 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Evolution Nature Corp. →

Supplemental notice from Evolution Nature Corp. d/b/a The Evolution Store regarding unauthorized access to its e-commerce site. Unauthorized users accessed customer data via valid administrative credentials between March 2 and August 19, 2014. Up to 838 customers affected, including 7 NH residents. Data exposed included names, addresses, and credit card details. Remediation included password resets, IP blocking, and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 198 days

discovery → filing · 7 weeks / 52 days

Mar 2, 2014

Begins

Sep 16, 2014

Discovered

Nov 7, 2014

Filed

vs. sector median

2 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_a270359423666e242014-10-09 · +29dVerified
California State AGbd_d88c612348e706cd2014-10-09 · +29dCandidate

Name: Evolution Nature Corp.
norm: evolution nature

Name: Evolution Nature Corp.
norm: evolution nature
Also named: Evolution Nature Corp.dba oflegal entity
The Evolution Storedba oftrade name
Industry: Retail & Consumerllm

Discovered: Sep 16, 2014
Breach occurred: Mar 2, 2014 – Aug 19, 2014
Undetected for: 198 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 27, 2014
Affected individuals: 838state + nationwide
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified NH Attorney GeneralProvided notice to necessary regulators
Initial access: valid_credentials

During the incident: Retained forensic investigator Stroz Friedberg, LLC
Changed all administrative passwords to twenty character random strings
Blocked all public IP addresses from logging into the e-commerce site back-end
Provided notice to necessary regulators
Provided notice to potentially affected individuals
Provided notice to card processor and merchant bank
Provided notice to Consumer Reporting Agencies
Retained AllClear ID to provide access to one year of free credit monitoring
Changes made: Analysis of systems and processes
Implementing additional measures to secure personal information
Improving existing security of systems
Reviewing policies, procedures and employee education
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 9 · first

California State AGOct 9 · first

New Hampshire State AG+29d · this page

Pattern: first filing Oct 9 (NH), last Nov 7 (NH) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/evolution-nature-20141107.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 7, 2014
Raw hash: bb75b0a4609677638a75c30f465c5052646cead0f5c442b41c4965ff682ce9ac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEvolution Nature Corp.

Victim entityEvolution Nature Corp.

Incidentdiscovered Sep 16, 2014

Stated responseRetained forensic investigator Stroz Friedberg, LLC

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov