HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

North 40 Outfitters

bd_c382d77b4fab019c · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2018

Filed

Feb 19, 2019

To disclose

15 weeks

Affected

83state residents only

Linked

7 filings

Confidence

66%

Full breach record for North 40 Outfitters →3 incidents on file

North 40 Outfitters notified the NH AG that suspicious activity on its online payment platform between Feb 2 and Nov 20, 2018, may have exposed customer names, card numbers, CVVs, and usernames/passwords. Discovered Nov 8, 2018. 83 NH residents affected. Notices sent Feb 14, 2019. Forensic investigation engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 279 days

discovery → filing · 15 weeks / 103 days

Feb 2, 2018

Begins

Nov 8, 2018

Discovered

Feb 19, 2019

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_4b668a3582761b702019-02-14 · +5dCandidate
Washington State AGbd_91ec3d5509abff2e2019-02-14 · +5dVerified by operator
Oregon State AGbd_9f6005ba312469512019-02-14 · +5dVerified
Massachusetts State AGbd_b52d773a93fb37ee2019-02-14 · +5dVerified

Show 2 more filings ↓up to 69d gap

California State AGbd_e64ead328d32d9722019-02-14 · +5dVerified
New Hampshire State AGbd_413daf193a69e1642019-04-29 · +69dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: North 40 Outfitters
norm: north 40 outfitters
Industry: Retail & Consumerllm

Discovered: Nov 8, 2018
Breach occurred: Feb 2, 2018 – Nov 20, 2018
Undetected for: 279 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2019
Affected individuals: 83state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: reported this incident to the credit card companiesproviding written notice of this incident to other state regulators and the consumer reporting agencies
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a third-party forensic firm
Provided notice to individuals whose credit and debit cards were used
Working to implement additional safeguards and training to its employees
Continues to monitor its e-commerce environment
Providing all impacted individuals with guidance on how to better protect against identity theft and fraud
Reported this incident to the credit card companies
Providing written notice of this incident to other state regulators and the consumer reporting agencies
Changes made: Implement additional safeguards and training to its employees
Monitor its e-commerce environment to guard against suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Montana State AGFeb 14 · first

Washington State AGFeb 14 · first

Oregon State AGFeb 14 · first

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first

New Hampshire State AG+5d · this page

New Hampshire State AG+74d

Pattern: first filing Feb 14 (MT), last Apr 29 (NH) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-40-outfitters-20190219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2019
Raw hash: 98567aff723bf75e348af318d32744c1ff917bfd8fa01ba3150c90d610652eb3

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityNorth 40 Outfitters

Incidentdiscovered Nov 8, 2018

Stated responseLaunched an investigation with the assistance of a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov