HackingRetail & ConsumerRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Scrapbook.com

bd_cb403336ed335e6c · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 26, 2018

Filed

Oct 22, 2018

To disclose

26 days

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Scrapbook.com →2 incidents on file

Scrapbook.com, LLC notified the NH Attorney General of a security incident involving third-party vendor Shopper Approved. Unauthorized code in a vendor seal captured customer payment card data (names, addresses, emails, card numbers, CVVs) from Sept 14-17, 2018. 3 NH residents affected. Notifications mailed Oct 19, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 26 days

Sep 14, 2018

Begins

Sep 26, 2018

Discovered

Oct 22, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Part of Shopper Approved, LLC supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_cf23dc9a0d35b24c2018-10-19 · +3dCandidate
Massachusetts State AGbd_f075e41f542d79942018-10-19 · +3dVerified

Name: Scrapbook.com
norm: scrapbookcom
Domain: scrapbook.com

Name: Scrapbook.com
norm: scrapbookcom
Domain: scrapbook.com
Industry: Retail & Consumerllm

Discovered: Sep 26, 2018
Breach occurred: Sep 14, 2018 – Sep 17, 2018
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 19, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: supply_chain

During the incident: Removed the Shopper Approved seal from its website
Began working with Shopper Approved to determine the nature and scope of the incident
Mailed notification letters to customers who placed an order during the time period identified by Shopper Approved
Changes made: Shopper Approved is continuing to review and enhance its security measures
Shopper Approved contacted law enforcement and is continuing to support law enforcement's investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 19 · first

Massachusetts State AGOct 19 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/scrapbook-20181022.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 22, 2018
Raw hash: e607b18b4c852a94a474abc0ccc99e3c9dcea5c9c642d6651c845e627c5a55ca

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityScrapbook.com

Victim entityScrapbook.com

Incidentdiscovered Sep 26, 2018

Stated responseRemoved the Shopper Approved seal from its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov