HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedGovernment IDFinancial accountHealth (basic)MediumContained

Sears Hometown Stores, Inc.

bd_d730ef31d984b2e2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 24, 2021

Filed

Aug 27, 2021

To disclose

9 weeks

Affected

9state residents only

Linked

2 filings

Confidence

66%

Full breach record for Sears Hometown Stores, Inc. →2 incidents on file

Sears Hometown Stores, Inc. reported a data breach involving its third-party HR provider, Transform SR Holding Management LLC. Unauthorized access to employee data occurred between June 3 and June 15, 2021, and was discovered on June 24, 2021. The breach affected 9 New Hampshire residents, exposing Social Security numbers, financial account numbers, and healthcare insurance information. Sears Hometown notified the NH Attorney General on August 27, 2021, and sent notifications to affected individuals on August 24, 2021, offering 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 9 weeks / 64 days

Jun 3, 2021

Begins

Jun 24, 2021

Discovered

Aug 27, 2021

Filed

vs. sector median

+2 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_e86f2bcad68028e82021-08-24 · +3dCandidate

Name: Sears Hometown Stores, Inc.
norm: sears hometown stores

Name: Sears Hometown Stores, Inc.
norm: sears hometown stores
Industry: Retail & Consumerllm

Discovered: Jun 24, 2021
Breach occurred: Jun 3, 2021 – Jun 15, 2021
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 24, 2021
Affected individuals: 9state-resident count only
Data types: Government IDFinancial accountHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified Consumer Protection Bureau, Office of the Attorney General, State of New Hampshire
Third party: via Transform SR Holding Management LLC
Initial access: supply_chain

During the incident: Sent written notification through first class mail to the nine (9) affected individuals who are residents of your State on August 24, 2021
Attached the letter being sent to affected residents by Transformco on our behalf
Transformco is also offering free identity monitoring services through Kroll, Inc. for a period of 12 months for persons wishing to enroll
Law enforcement has been notified
Changes made: Implementing additional security measures to enhance the security of our network
Continuing to provide training to our employees concerning phishing threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 24 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sears-hometown-stores-20210827.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2021
Raw hash: 77b69a36b5046a7cb53a19465d8f29d1c4a3894412a704f8ccea203c6172317c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySears Hometown Stores, Inc.

Victim entitySears Hometown Stores, Inc.

Incidentdiscovered Jun 24, 2021

Stated responseSent written notification through first class mail to the nine (9) affected individuals who are residents of your State on August 24, 2021

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov