HackingRetail & ConsumerRetailStolen CredentialsTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

Sophia Institute Press

bd_c54828ce4eb18d6b · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 17, 2022

Filed

Dec 16, 2022

To disclose

39 weeks

Affected

232state residents only

Linked

6 filings

Confidence

66%

Full breach record for Sophia Institute Press →

Sophia Institute Press notified NH AG of a cyber-attack compromising payment card data (name, number, CVV) for 232 NH residents. Unauthorized access occurred between Nov 26, 2021 and Jul 23, 2022. Suspicious activity detected March 17, 2022. Investigation confirmed malware stole card data. Notices sent Dec 12, 2022. Forensic specialists engaged; law enforcement notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 111 days

discovery → filing · 39 weeks / 274 days

Nov 26, 2021

Begins

Mar 17, 2022

Discovered

Dec 16, 2022

Filed

vs. sector median

+30 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_bc35dccdb2c7a2562022-12-13 · +3dVerified
Maine State AGbd_7ec35e9f1817a4b02022-12-12 · +4dCandidate
Indiana State AGbd_8f7b642c5cd834be2022-12-12 · +4dVerified
California State AGbd_918fc0a0441e94a12022-12-12 · +4dVerified

Show 1 more filing ↓up to 4d gap

Montana State AGbd_f4a95038116058e62022-12-12 · +4dVerified by operator

Name: Sophia Institute Press
norm: sophia institute press
Domain: sophiainstitute.com

Name: Sophia Institute Press
norm: sophia institute press
Domain: sophiainstitute.com
Industry: Retail & Consumerllm

Discovered: Mar 17, 2022
Breach occurred: Nov 26, 2021 – Jul 23, 2022
Undetected for: 111 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 12, 2022
Affected individuals: 232state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified state regulators, as requiredNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Began working with third-party forensic specialists
Took steps to implement additional procedures to further protect the security of customer debit and credit card information
Notified federal law enforcement
Provided written notice to impacted individuals
Notified major payment card brands and its card processor
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Working to improve security protocols already in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(274 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGDec 12 · first

Indiana State AGDec 12 · first

California State AGDec 12 · first

Montana State AGDec 12 · first

Massachusetts State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sophia-institute-press-20221216.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2022
Raw hash: 05dddea3238ff4d21749ee3a1333762fe60390820d4c2f860830c32f7ed79c9b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySophia Institute Press

Victim entitySophia Institute Press

Incidentdiscovered Mar 17, 2022

Stated responseBegan working with third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov