HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountLowContained

American Tool Supply

bd_c58c4d5fdba9f902 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2012

Filed

Nov 19, 2012

To disclose

16 weeks

Affected

23state residents only

Linked

3 filings

Confidence

66%

Full breach record for American Tool Supply →

American Tool Supply notified the NH Attorney General on Nov 19, 2012, of a potential security incident discovered Aug 1, 2012. Hackers accessed the online ordering system in June 2012, compromising customer names and credit card numbers. 23 NH residents affected. ATS engaged IBM X-Force forensics, disabled the system, and provided 12 months of identity protection via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 61 days

discovery → filing · 16 weeks / 110 days

Jun 1, 2012

Begins

Aug 1, 2012

Discovered

Nov 19, 2012

Filed

vs. sector median

+8 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_f810d703e7ffd3132012-11-19Candidate
Massachusetts State AGbd_103fcbd5e257fdbc2012-11-20 · +1dVerified

Name: HOLLAND & KNIGHT LLP
norm: holland knight

Name: American Tool Supply
norm: american tool supply
Industry: Retail & Consumerllm

Discovered: Aug 1, 2012
Breach occurred: Jun 1, 2012
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2012
Affected individuals: 23state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Consumer Protection and Antitrust Bureau, Office of the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Suspended the ATS System
Removed all financial information that was stored on it
Initiated an internal investigation
Engaged the IBM X-Force forensics team
Sent an initial notice to certain customers
Sending notice to the New Hampshire residents
Partnered with AllClear ID to help protect the potentially affected individuals from identity theft
Purchased for those individuals twelve months of AllClear ID's identity protection service
Provided the affected residents with a toll-free number
Changes made: Introducing new security measures to prevent an incident like this from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGNov 19 · first

New Hampshire State AGNov 19 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-tool-supply-20121119.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2012
Raw hash: 91b4fd13322f84b4fafb2b45b1696fab9ac76c010a42ba261f17b2727fc3e8a5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHOLLAND & KNIGHT LLP

Victim entityAmerican Tool Supply

Incidentdiscovered Aug 1, 2012

Stated responseSuspended the ATS System

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov