HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowActive

Wine Library

bd_c190633fc5461113 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 20, 2011

Filed

Jan 24, 2012

To disclose

14 weeks

Affected

230state residents only

Linked

2 filings

Confidence

66%

Full breach record for Wine Library →

Wine Library notified NH AG of a data breach occurring Oct 20-Nov 7, 2011. Hackers based in China accessed customer PII, credit card info (including CVV/expiry), and account credentials. 230 NH residents affected. Wine Library retained forensic experts (Kroll, Trustwave) and counsel, removed stored credit card data, launched a new secure site with tokenization/SSL, and notified customers and NJ State Police.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 96 days

Oct 20, 2011

Begins

Oct 20, 2011

Discovered

Jan 24, 2012

Filed

vs. sector median

+6 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_76d3e07e1f2a1f7f2012-01-30 · +6dVerified

Name: Wine Library
norm: wine library

Name: Wine Library
norm: wine library
Industry: Retail & Consumerllm

Discovered: Oct 20, 2011
Breach occurred: Oct 20, 2011 – Nov 7, 2011
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2011
Affected individuals: 230state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Jersey State Police Regional Operations Intelligence CenterProvided notice to the three major consumer credit reporting agencies (Experian, Equifax and Trans Union)
Initial access: exploit_public_facing

During the incident: Retained breach notification legal counsel, Nelson, Levine, de Luca & Horst, LLC
Retained forensic computer analysts, Kroll OnTrack and Trustwave
Removed stored credit card data from WineLibrary.com
Published notice of the potential breach on the WineLibrary.com blog
Informed affected individuals via email
Sent printed notification to all involved individuals
Notified the New Jersey State Police Regional Operations Intelligence Center
Provided notice to the three major consumer credit reporting agencies
Changes made: Launched a new website with best-in-class security protocols
Tokenizing credit card data
Encrypting the transfer of customer data through the latest versions of SSL technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 24 · first · this page

Massachusetts State AG+6d

Pattern: first filing Jan 24 (NH), last Jan 30 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wine-library-20120124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2012
Raw hash: 3bb64c3c0750a4fa741e8aa63ae6cd9b53f5f3c4287d2174796cbb2a06b939cb

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWine Library

Victim entityWine Library

Incidentdiscovered Oct 20, 2011

Stated responseRetained breach notification legal counsel, Nelson, Levine, de Luca & Horst, LLC

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov