AccidentalRetail & ConsumerRetailMisconfigurationCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Hnilo Naturals LLC

bd_ccf3504fa3ecc8b1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 21, 2021

Filed

Jun 14, 2021

To disclose

8 weeks

Affected

28state residents only

Linked

4 filings

Confidence

66%

Full breach record for Hnilo Naturals LLC →2 incidents on file

Hnilo Naturals LLC (d/b/a Alitura Naturals) notified NH AG of a security incident where malicious code was present on its website from Oct 2020 to May 2021. The malware impacted payment card info and names of 28 NH residents. The company removed the code and launched a new secure e-commerce platform.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 202 days

discovery → filing · 8 weeks / 54 days

Oct 1, 2020

Begins

Apr 21, 2021

Discovered

Jun 14, 2021

Filed

vs. sector median

on median

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_88d1eb8fe91f9f602021-06-09 · +5dVerified
Maine State AGbd_e73fb91d0d64aad42021-06-09 · +5dVerified
Montana State AGbd_64919219efbe1ebf2021-06-08 · +6dCandidate

Name: Hnilo Naturals LLC
norm: hnilo naturals
Domain: alituranaturals.com

Name: Hnilo Naturals LLC
norm: hnilo naturals
Domain: alituranaturals.com
Also named: Hnilo Naturals LLCdba oflegal entity
Alitura Naturalsdba oftrade name
Industry: Retail & Consumerllm

Discovered: Apr 21, 2021
Breach occurred: Oct 1, 2020 – May 7, 2021
Undetected for: 202 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2021
Affected individuals: 28state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Immediately took steps to remove the code
Began an internal investigation with the assistance of external technical experts
Eliminated the code that enabled the unauthorized access
Accelerated planned data security upgrades
Launched its new website on an e-commerce platform with more robust data security controls
Notifying its affected customers
Changes made: Accelerated planned data security upgrades
Launched its new website on an e-commerce platform with more robust data security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJun 8 · first

California State AG+1d

Maine State AG+1d

New Hampshire State AG+6d · this page

Pattern: first filing Jun 8 (MT), last Jun 14 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hnilo-naturals-20210614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2021
Raw hash: 14da10196bc2d011202f9f331b75dada2ca3a8573bbba6403ca12221bfdf47c3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHnilo Naturals LLC

Victim entityHnilo Naturals LLC

Incidentdiscovered Apr 21, 2021

Stated responseImmediately took steps to remove the code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov