HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsMediumContained

Sexy Lingerie & Costume Store

bd_b4b2123032e911ec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 18, 2014

Filed

Sep 8, 2014

To disclose

21 days

Affected · nationwide

44,724202 in this filing

Linked

3 filings

Confidence

68%

Yandy.com notified the NH Attorney General of an unauthorized cyber-attack discovered on August 18, 2014. The incident exposed payment card data (names, addresses, card numbers, CVVs, emails) for approximately 44,724 individuals, including 202 NH residents. Yandy.com stopped the attack, filed an IC3 complaint, and began notifying affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Aug 18, 2014

Discovered

Sep 8, 2014

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_ebae4091d33b9c212014-09-08Candidate
Massachusetts State AGbd_7ff70a3a900e63382014-09-09 · +1dVerified

Name: Sexy Lingerie & Costume Store
norm: sexy lingerie costume store
Domain: yandy.com

Name: Sexy Lingerie & Costume Store
norm: sexy lingerie costume store
Domain: yandy.com
Industry: Retail & Consumerllm

Discovered: Aug 18, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 44,724state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney GeneralFiled a complaint with the Internet Crime Complaint Center (co-sponsored by the FBI and the National White Collar Crime Center)
Initial access: exploit_public_facing

During the incident: Took immediate steps to stop the attack and restore the integrity of its website
Filed a complaint with the Internet Crime Complaint Center
Began notifying the affected individuals
Changes made: Reexamining its current data privacy and security policies and procedures to find ways of reducing the risk of future data breaches
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGSep 8 · first

New Hampshire State AGSep 8 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/yandy-20140908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2014
Raw hash: e1229b3bfc553056f67256229e9cf56e464b2e90a5b740b1d36fb036e03b7265

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySexy Lingerie & Costume Store

Victim entitySexy Lingerie & Costume Store

Incidentdiscovered Aug 18, 2014

Stated responseTook immediate steps to stop the attack and restore the integrity of its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov