HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)Financial accountCredentialsLowContained

My Favorite Things

bd_aac23ed690a997f8 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Dec 7, 2017

To disclose

—

Affected

10state residents only

Confidence

66%

My Favorite Things (MFT) notified customers that their electronic order and payment system was compromised between June 22, 2017, and August 15, 2017. The breach likely involved compromised vendor credentials, exposing names, billing/shipping addresses, credit card info, and contact details. MFT engaged forensic investigators, removed malware, reset credentials, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 22, 2017

Begins

Dec 7, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10 affectedView incident

Name: My Favorite Things
norm: my favorite things

Name: My Favorite Things
norm: my favorite things
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jun 22, 2017 – Aug 15, 2017
Materiality determined: —
Notification sent: Dec 14, 2017
Affected individuals: 10state-resident count only
Data types: PIIIdentity (basic)Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Undertaken measures to protect all of our customers’ personal information from further unauthorized access
Discovered, contained, and removed the operative malicious software responsible for the breach
Remediated the administrative account that was responsible for the breach
Reset all of the administrators’ credentials
Hired an outside forensic company to investigate the breach
Offering to pay for one year of credit monitoring service through TransUnion
Changes made: Remediated the administrative account that was responsible for the breach
Reset all of the administrators’ credentials
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/MFTStamps.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 7, 2017
Raw hash: 65ff7265d221dd720d3f9a55d7091c3f87c7f963428cb71f2280dbed645cb717

Reporting entityMy Favorite Things

Victim entityMy Favorite Things

IncidentThird-Party / Supply Chain

Stated responseUndertaken measures to protect all of our customers’ personal information from further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov