DisclosureLens
HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

AmeriCommerce by Cart.com

bd_d69ec2d9bfbf8a99 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 29, 2021

Filed

Apr 23, 2021

To disclose

25 days

Affected

30state residents only

Linked

5 filings

Confidence

65%
Full breach record for AmeriCommerce by Cart.com →

AmeriCommerce by Cart.com notified the New Hampshire Attorney General of a security incident affecting 30 NH residents. Unauthorized code was added to merchant checkout pages between March 25 and March 29, 2021, capturing customer payment card data (numbers, CVV, expiration) and PII. The code was removed, law enforcement was notified, and notification letters were mailed starting April 23, 2021.

Incident timeline

undetected · 4 days
discovery → filing · 25 days

Mar 25, 2021

Begins

Mar 29, 2021

Discovered

Apr 23, 2021

Filed

vs. sector median

15 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Massachusetts State AGApr 23 · first
Maine State AGApr 23 · first
Montana State AGApr 23 · first
Indiana State AGApr 23 · first
New Hampshire State AGApr 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.