HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountLowContained

Peaceful Valley Farm Supply, Inc.

bd_bca7455d936f370d · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 22, 2018

Filed

Sep 11, 2018

To disclose

20 days

Affected

88state residents only

Linked

5 filings

Confidence

66%

Full breach record for Peaceful Valley Farm Supply, Inc. →

Peaceful Valley Farm Supply, Inc. notified the NH Attorney General of a data breach affecting 88 NH residents. Unauthorized access occurred between Feb 9 and Aug 22, 2018, via malicious software on the website. Exposed data included names, addresses, payment card numbers, and emails. Malware was removed on Aug 22, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 194 days

discovery → filing · 20 days

Feb 9, 2018

Begins

Aug 22, 2018

Discovered

Sep 11, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_6ed5bbd16af3fbcf2018-09-11Verified
Washington State AGbd_d41474a6366319bc2018-09-11Verified
Oregon State AGbd_2d29e2dafba284cf2018-09-12 · +1dCandidate
Massachusetts State AGbd_15b58d3d197a63202018-09-19 · +8dVerified

Name: Peaceful Valley Farm Supply, Inc.
norm: peaceful valley farm supply

Name: Peaceful Valley Farm Supply, Inc.
norm: peaceful valley farm supply
Industry: Retail & Consumerllm

Discovered: Aug 22, 2018
Breach occurred: Feb 9, 2018 – Aug 22, 2018
Undetected for: 194 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2018
Affected individuals: 88state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: The malicious software has been removed as of 8/22/18 from our website
Implemented security measures to ensure the confidentiality of the personal information of those we serve
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Implemented security measures to ensure the confidentiality of the personal information of those we serve
Implemented additional security measures designed to prevent a recurrence of such an attack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGSep 11 · first

Washington State AGSep 11 · first

New Hampshire State AGSep 11 · first · this page

Oregon State AG+1d

Massachusetts State AG+8d

Pattern: first filing Sep 11 (CA), last Sep 19 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/peaceful-valley-20180911.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2018
Raw hash: 63064f37ae555a7161d67a0566e29179885f434ac8c2a907c82a25eead549ec2

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPeaceful Valley Farm Supply, Inc.

Victim entityPeaceful Valley Farm Supply, Inc.

Incidentdiscovered Aug 22, 2018

Stated responseThe malicious software has been removed as of 8/22/18 from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov