HackingOtherStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Hello Doggie, Inc.

bd_cef6508a85debc26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2020

Filed

May 27, 2020

To disclose

7 weeks

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for Hello Doggie, Inc. →

Hello Doggie, Inc. notified the NH AG of a breach affecting 5 NH residents. Unauthorized access to a company email account occurred as early as March 23, 2020, discovered April 6, 2020. Exposed data included names, addresses, SSNs, financial accounts, and health insurance info. Notices sent May 22, 2020, offering 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 7 weeks / 51 days

Mar 23, 2020

Begins

Apr 6, 2020

Discovered

May 27, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_14a3876ecc9cbb8c2020-05-27Verified
Indiana State AGbd_84b40cbf733517872020-05-22 · +5dVerified

Name: HELLO!
norm: hello
Domain: hellomagazine.com

Name: Hello Doggie, Inc.
norm: hello doggie
Industry: Otherllm

Discovered: Apr 6, 2020
Breach occurred: Mar 23, 2020
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 22, 2020
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: valid_credentials

During the incident: Promptly reset account credentials and updated email account settings
Launched an investigation involving external forensic experts
Contacted law enforcement
Changes made: Reviewing and updating its security practices
Moving to a cloud-based service to enhance protections for the transmission of data
Implementing additional training regarding security for email accounts
Implementing additional phishing awareness training and password-related controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMay 22 · first

Massachusetts State AG+5d

New Hampshire State AG+5d · this page

Pattern: first filing May 22 (IN), last May 27 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hello-doggie-20200527.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2020
Raw hash: 73f0142a17a43e526b8944784775106db4288ea424cc7571fea93d92470d598b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHELLO!

Victim entityHello Doggie, Inc.

Incidentdiscovered Apr 6, 2020

Stated responsePromptly reset account credentials and updated email account settings

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov