MalwareRetail & ConsumerRetailRansomwareData ExfiltratedTargetedPIIIdentity (basic)Financial accountLowContained

Memory4Less

bd_bc42a66bfdfe8f3a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 24, 2017

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Memory4Less →

Memory4Less notified Montana residents of a data breach occurring between November 2016 and September 2017. An intruder installed malicious software, compromising customer PII including names, emails, credit card numbers, and shipping account numbers. The company engaged Kroll for investigation and remediation, notified law enforcement, and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2016

Begins

Oct 24, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_d0cf903244992ced2017-10-24Verified
Massachusetts State AGbd_d2ccbfa94633a5172017-10-25 · +1dVerified

Name: Memory4Less
norm: memory4less

Name: Memory4Less
norm: memory4less
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Nov 1, 2016 – Sep 30, 2017
Materiality determined: —
Notification sent: Jan 25, 2018
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1059 Command and Scripting Interpreter
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement officials
Initial access: exploit_public_facing

During the incident: Retained Kroll to investigate the incident
Identified the source of the breach
Corrected the vulnerability in the network
Informed law enforcement officials
Secured the network to prevent recurrence
Provided one year of identity monitoring services through Kroll
Changes made: Corrected the vulnerability in the network
Secured the network to help prevent this issue from occurring again
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 24 · first

Montana State AGOct 24 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Memory4Less.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2017
Raw hash: 45280fa5ae195651c26806af96a1050b549f5ddb80bf4747e0f4031ec24472fa

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMemory4Less

Victim entityMemory4Less

IncidentRansomware

Stated responseRetained Kroll to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov