HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)CredentialsFinancial accountLowContained

iPromo

bd_cfe32523cad22517 · schema v1 · pii pii-v2

Severity

Low

Discovered

Nov 27, 2012

Filed

Dec 3, 2012

To disclose

6 days

Affected

29state residents only

Confidence

66%

Full breach record for iPromo →

iPromo notified the NH Attorney General that its website was breached on November 12, 2012, with discovery on November 27, 2012. The incident involved unauthorized exposure of an old customer data file containing PII (names, addresses, emails, passwords) and masked/unmasked credit card data. A maximum of 29 New Hampshire residents were affected. iPromo stated it has taken measures to secure data and is cooperating with legal authorities.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 6 days

Nov 12, 2012

Begins

Nov 27, 2012

Discovered

Dec 3, 2012

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed29 affectedView incident

Name: iPromo
norm: ipromo
Domain: ipromo.com

Name: iPromo
norm: ipromo
Domain: ipromo.com
Industry: Retail & Consumerllm

Discovered: Nov 27, 2012
Breach occurred: Nov 12, 2012
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 29state-resident count only
Data types: Identity (basic)CredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Attorney General Michael A. Delaney, Office of the Attorney General, NH
Initial access: exploit_public_facing

During the incident: Sent letters to alert affected New Hampshire residents of the breach
Cooperating with legal authorities to help bring those responsible to justice
Changes made: Taken significant measures to remediate any future risk and secure all data stored on our sites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ipromo-20121203.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 3, 2012
Raw hash: efe519527d9ab0099ad39d7feb57d8bd22e10290b65413c55278764fd428644d

Reporting entityiPromo

Victim entityiPromo

Incidentdiscovered Nov 27, 2012

Stated responseSent letters to alert affected New Hampshire residents of the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov