HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Crafts Americana Group

bd_b89714d161eee4d9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 25, 2013

Filed

Feb 8, 2013

To disclose

14 days

Affected

134state residents only

Linked

3 filings

Confidence

67%

Full breach record for Crafts Americana Group →

Crafts Americana Group notified NH AG of a security breach involving unauthorized access to internet servers via an Adobe ColdFusion vulnerability. Discovered Jan 25, 2013, the incident affected 134 NH residents, exposing names, addresses, phone numbers, and credit card numbers from late 2012 online purchases.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 35 days

discovery → filing · 14 days

Dec 21, 2012

Begins

Jan 25, 2013

Discovered

Feb 8, 2013

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_c12d483d00e675ea2013-02-11 · +3dVerified
Massachusetts State AGbd_60dcd83204b4dcdf2013-02-12 · +4dVerified

Name: Perkins Coie LLP
norm: perkins coie
Domain: perkinscoie.com

Name: Crafts Americana Group
norm: crafts americana
Domain: craftsamericana.com
Industry: Retail & Consumerllm

Discovered: Jan 25, 2013
Breach occurred: Dec 21, 2012
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 134state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Identified and removed the malicious file
Patched the servers by applying the needed fixes
Notified law enforcement
Informed the payment card networks
Scheduling a PCI forensics investigation
Changes made: Patched the servers by applying the needed fixes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 8 · first · this page

California State AG+3d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/crafts-americana-20130208.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2013
Raw hash: 0da811d8472c18d5ac125fda52dc3deaf5b02811bd786ed39bbd6902e8a07074

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPerkins Coie LLP

Victim entityCrafts Americana Group

Incidentdiscovered Jan 25, 2013

Stated responseIdentified and removed the malicious file

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov