HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Natural Habitat, Inc.

bd_d6c9cafc0e5eaa6f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 24, 2020

Filed

Apr 28, 2021

To disclose

31 weeks

Affected

115state residents only

Linked

4 filings

Confidence

66%

Full breach record for Natural Habitat, Inc. →

Natural Habitat, Inc. notified the New Hampshire Attorney General of a data security incident affecting 115 NH residents. Unauthorized third-party access occurred from Sept 22-24, 2020. Data included names, DOB, passport numbers, and limited health info. Nat Hab engaged forensic investigators, secured systems, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 31 weeks / 216 days

Sep 22, 2020

Begins

Sep 24, 2020

Discovered

Apr 28, 2021

Filed

vs. sector median

+23 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_2c5032d637aa928e2021-04-28Verified
Montana State AGbd_a6cb9cf5d409d7882021-04-28Verified
Illinois State AGbd_ce6461b58364fc412021-01-01 · +117dCandidate

Name: Natural Habitat, Inc.
norm: natural habitat

Name: Natural Habitat, Inc.
norm: natural habitat
Industry: Retail & Consumerllm

Discovered: Sep 24, 2020
Breach occurred: Sep 22, 2020 – Sep 24, 2020
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2021
Affected individuals: 115state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Securing its systems to prevent further access
Retaining a leading forensic security firm to investigate and confirm the overall security of its computer systems
Notifying the potentially affected individuals
Providing guidance on what they can do to protect themselves
Offering one year of complimentary credit monitoring and identity theft protection
Changes made: Enhancing our technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(216 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+117d

Montana State AG+117d

New Hampshire State AG+117d · this page

Pattern: first filing Jan 1 (IL), last Apr 28 (NH) — a 117-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/natural-habitat-20210428.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2021
Raw hash: 2e06a3cea36a9455b9e114384c55315cf32c4a745413106a430a5ff5732c1bef

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNatural Habitat, Inc.

Victim entityNatural Habitat, Inc.

Incidentdiscovered Sep 24, 2020

Stated responseSecuring its systems to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov