HackingRetail & ConsumerRetailStolen CredentialsTargetedIdentity (basic)LowContained

Haynes Furniture Company, Inc.

bd_da3814824e358ac3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 5, 2021

Filed

Sep 20, 2021

To disclose

7 weeks

Affected

16state residents only

Linked

5 filings

Confidence

64%

Full breach record for Haynes Furniture Company, Inc. →2 incidents on file

Haynes Furniture Company, Inc. notified individuals of a data security incident where an unauthorized actor accessed systems between April 2-4, 2021. The company discovered the incident in August 2021. Impacted data included names and other elements. Haynes engaged outside assistance, notified federal law enforcement, and enhanced remote access security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 125 days

discovery → filing · 7 weeks / 46 days

Apr 2, 2021

Begins

Aug 5, 2021

Discovered

Sep 20, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_a5fcbdd0b32c70de2021-09-20Verified
Maine State AGbd_c060070b2b7ea9b62021-09-20Candidate
Massachusetts State AGbd_daec735758f567b12021-09-20Verified
New Hampshire State AGbd_c5dcd35a9b1abec22021-09-24 · +4dVerified

Name: Haynes Furniture Company, Inc.
norm: haynes furniture

Name: Haynes Furniture Company, Inc.
norm: haynes furniture
Industry: Retail & Consumerllm

Discovered: Aug 5, 2021
Breach occurred: Apr 2, 2021 – Apr 4, 2021
Undetected for: 125 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 8, 2021
Affected individuals: 16state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: correspondence with federal law enforcement authorities
Initial access: valid_credentials

During the incident: Launched an investigation with outside assistance
Prompt and continued correspondence with federal law enforcement authorities
Changed system passwords
Upgraded infrastructure hardware
Changes made: Implemented enhanced security controls on our remote access system
Reviewed our existing policies and procedures relating to data protection and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 20 · first

Maine State AGSep 20 · first

Massachusetts State AGSep 20 · first

Montana State AGSep 20 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2021
Raw hash: c9ecfe30afeb77250e36d797a2895f8d88a4326101e24c07d92516ed865f6b46

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHaynes Furniture Company, Inc.

Victim entityHaynes Furniture Company, Inc.

Incidentdiscovered Aug 5, 2021

Stated responseLaunched an investigation with outside assistance

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov