HackingRetail & ConsumerRetailCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Enesco Parent, LLC

bd_bd431d7735ada571 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 13, 2021

Filed

Nov 12, 2021

To disclose

13 weeks

Affected

25state residents only

Linked

6 filings

Confidence

66%

Full breach record for Enesco Parent, LLC →

Enesco, LLC detected a network security incident on August 13, 2021, where an unauthorized third party infiltrated its network. Data exfiltration occurred on or before August 13. Compromised data included names, addresses, birth dates, SSNs, and direct deposit info for employees and dependents. 25 New Hampshire residents were notified on November 2, 2021. Enesco engaged forensic specialists, reported to the FBI, and implemented enhanced security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 91 days

Aug 13, 2021

Begins

Aug 13, 2021

Discovered

Nov 12, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_4127c848810fecee2021-11-12Verified
Montana State AGbd_becc40e3c01073022021-11-12Verified
Massachusetts State AGbd_ef489b293dee96d12021-11-12Verified
Indiana State AGbd_ce7a7b55559361c52021-11-02 · +10dVerified

Show 1 more filing ↓up to 315d gap

Illinois State AGbd_9721e2154db0ce982021-01-01 · +315dCandidate

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Enesco Parent, LLC
norm: enesco parent
Also named: Enesco Parent, LLCdba oflegal entity
Enesco, LLCdba oftrade name
Industry: Retail & Consumerllm

Discovered: Aug 13, 2021
Breach occurred: Aug 13, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 2, 2021
Affected individuals: 25state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported this matter to the FBI
Initial access: exploit_public_facing

During the incident: Engaged specialized third-party forensic and technical resources
Reported this matter to the FBI
Conducted an investigation with the assistance of third-party forensic specialists
Secured and remediated its network and the data it maintains
Changes made: Implemented additional cybersecurity training
Put in place additional technical and operational safeguards, including geo-fencing, firewall updates, and endpoint detection and response software
Reviewing and altering its policies and procedures relating to the security of systems and servers
Reviewing and altering its information life cycle management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(91 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+305d

Maine State AG+315d

Montana State AG+315d

Massachusetts State AG+315d

New Hampshire State AG+315d · this page

Pattern: first filing Jan 1 (IL), last Nov 12 (NH) — a 315-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/enesco-parent-dba-enesco-20211112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2021
Raw hash: ea254b2853703c4466ae68b559b7d75666f8d693a2636801f9f8cd0da387bc99

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityEnesco Parent, LLC

Incidentdiscovered Aug 13, 2021

Stated responseEngaged specialized third-party forensic and technical resources

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov