HackingProfessional ServicesProfessional ServicesSQL InjectionCustomer Data InvolvedPIIIdentity (basic)Financial accountLowContained

SCARBOROUGH & TWEED INC.

bd_c614e6d4d0e29c42 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2007

Filed

Oct 26, 2007

To disclose

8 weeks

Affected · nationwide

5702 in this filing

Confidence

66%

Full breach record for SCARBOROUGH & TWEED INC. →

Scarborough & Tweed notified regulators of a data security incident in late September 2007 involving SQL injection on its web server. Personal information, including credit card numbers, of 570 U.S. customers was potentially accessed. The firm shut down the server, notified the FBI and NY AG, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 55 days

Sep 1, 2007

Discovered

Oct 26, 2007

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed570 affectedView incident

Name: SCARBOROUGH & TWEED INC.
norm: scarborough tweed
Domain: scarboroughtweed.com

Name: SCARBOROUGH & TWEED INC.
norm: scarborough tweed
Domain: scarboroughtweed.com
Industry: Professional Servicesllm

Discovered: Sep 1, 2007
Materiality determined: —
Notification sent: Oct 18, 2007
Affected individuals: 570state + nationwide
Data types: PIIIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1530 Data from Cloud Storage Object
Threat actor: ExternalFinancial
Regulator citations: Contacted the New York office of the Federal Bureau of InvestigationsNotified the appropriate New York agencies, including the state Attorney General
Initial access: exploit_public_facing

During the incident: Shut down the involved server
Contacted the New York office of the Federal Bureau of Investigations
Notified the appropriate New York agencies
Notified affected customers by personal letter
Offered a year of free credit monitoring protection through the PrivacyGuard service offered by Trilegiant Corporation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/scarborough-tweed-20071226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2007
Raw hash: 3d4f9a07db795d4e16e39e29636217525174f6e367f0f56a8fd87efd8c48312f

Reporting entitySCARBOROUGH & TWEED INC.

Victim entitySCARBOROUGH & TWEED INC.

Incidentdiscovered Sep 1, 2007

Stated responseShut down the involved server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov