MalwareTechnologyInformationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedCredentialsFinancial accountLowContained

The Home of Transgender Animations and Comics

bd_a747be8af28a70b4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 1, 2020

Filed

Jan 28, 2021

To disclose

8 weeks

Affected

172state residents only

Linked

5 filings

Confidence

66%

SapphireFoxxBeyond.com notified the NH Attorney General of a breach affecting 172 NH residents. Malware installed in June 2020 captured keystrokes (credentials) and credit card data entered between June and Dec 12, 2020. The site notified users, reset passwords, and offered 2 years of Experian IdentityWorks. The site implemented additional security controls and threat detection software.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 183 days

discovery → filing · 8 weeks / 58 days

Jun 1, 2020

Begins

Dec 1, 2020

Discovered

Jan 28, 2021

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Idaho State AGbd_cab4e57fe15bb4f72021-01-27 · +1dVerified
Indiana State AGbd_2777ab4b8c876f292021-01-26 · +2dVerified
Montana State AGbd_bc38e8180c8ba9692021-01-26 · +2dCandidate
Massachusetts State AGbd_f286b2725d82d6e52021-01-26 · +2dVerified

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: The Home of Transgender Animations and Comics
norm: the home of transgender animations and comics
Domain: sapphirefoxxbeyond.com
Industry: Technologyllm

Discovered: Dec 1, 2020
Breach occurred: Jun 1, 2020 – Dec 12, 2020
Undetected for: 183 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 26, 2021
Affected individuals: 172state-resident count only
Data types: CredentialsFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_attachment

During the incident: Retained an outside forensic expert to investigate
Forensic expert removed malware from the Site on December 12, 2020
Notified all individuals who logged-on during that time that their username and password may have been compromised
Had all of its users reset their passwords for the Site
Recommended that users reset their passwords on other sites
Notified all users who had entered credit card numbers on SapphireFoxxBeyond.com between June and December 12 that their credit card numbers may have been compromised
Offered those individuals a two-year membership in Experian IdentityWorks protection services
Working with and continues to work with an outside technology security expert and the Site's data security attorneys to incorporate additional software and other security controls
Deployed additional server side threat detection and anti-malware protective software
Mandated password changes
Changes made: Deployed additional server side threat detection and anti-malware protective software
Mandated password changes
Incorporating additional code plug-ins into the site to ensure the highest level of security
Working with an outside forensic expert and cybersecurity attorney to ensure that we have taken all additional reasonable and appropriate measures designed to safeguard the confidentiality of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 26 · first

Montana State AGJan 26 · first

Massachusetts State AGJan 26 · first

Idaho State AG+1d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sapphirefoxxbeyond-20210128.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2021
Raw hash: d14adb102c344f8c7f2333cf34583d16cc0db4b29046e613edcf71923607988f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityThe Home of Transgender Animations and Comics

Incidentdiscovered Dec 1, 2020

Stated responseRetained an outside forensic expert to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov