HackingFinancial ServicesRetail & ConsumerFinanceVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountCredentialsLowContained

Synchrony Bank

bd_c51e4f1515181449 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 27, 2018

To disclose

—

Affected

28state residents only

Linked

3 filings

Confidence

67%

Full breach record for Synchrony Bank →3 incidents on file

Synchrony Bank notified the NH Attorney General of a breach at Stein Mart, Inc. involving unauthorized code on www.steinmart.com. The code accessed credit card data (name, address, email, account number, security code, expiration) for individuals shopping between Dec 28, 2017 and July 9, 2018. 28 NH residents affected. Synchrony Bank monitored accounts, removed the code, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 28, 2017

Begins

Nov 27, 2018

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_beb95b853866cbe02018-11-28 · +1dVerified
Montana State AGbd_cc107e59e21a37a92019-01-04 · +38dVerified

Name: Synchrony Bank
norm: synchrony bank

Name: Synchrony Bank
norm: synchrony bank
Industry: Financial ServicesllmRetail & Consumerllm

Discovered: —
Breach occurred: Dec 28, 2017 – Jul 9, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 28state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General, Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Began working with Stein Mart, Inc. to obtain data that would allow us to determine what had occurred
Began closely monitoring the potentially impacted accounts for unauthorized activity
Proactively implemented mitigation actions
Removed unauthorized code from the website
Removed third-party login feature from the website
Notified impacted residents by mail
Offered one year of credit monitoring at no cost to the cardholder
Changes made: New credit card may be issued with updated security credentials
Offered one-year subscription to a credit report monitoring service at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 27 · first · this page

Massachusetts State AG+1d

Montana State AG+38d

Pattern: first filing Nov 27 (NH), last Jan 4 (MT) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/synchrony-bank-20181127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2018
Raw hash: d53f3282aaab49e20c33e84c81683eb3020583d420acd60267e72876a06d1eea

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySynchrony Bank

Victim entitySynchrony Bank

IncidentThird-Party / Supply Chain

Stated responseBegan working with Stein Mart, Inc. to obtain data that would allow us to determine what had occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov