HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Handi Quilter

bd_db8b1ef4caf397ef · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 28, 2021

Filed

Jun 29, 2021

To disclose

≤1 day

Affected · nationwide

3,09617 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Handi Quilter →2 incidents on file

Handi Quilter, Inc. reported an external system breach (hacking) occurring between March 24, 2020, and April 29, 2021, discovered on June 28, 2021. The incident affected 3,096 individuals, including 17 Maine residents. Acquired data included names and financial account or credit/debit card numbers (with security codes/PINs). The company provided 12 months of credit monitoring via Transunion and identity restoration assistance.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 28, 2021 → Filed with AG Jun 29, 20211d ✓ ME AG ≤30d≤1 day discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 461 days

discovery → filing · ≤1 day / 1 days

Mar 24, 2020

Begins

Jun 28, 2021

Discovered

Jun 29, 2021

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4ff0a3b258031b692021-06-29Verified
Massachusetts State AGbd_d827c4f81390ae882021-06-29Verified
Montana State AGbd_fa9841f70febb2f62021-06-29Verified
New Hampshire State AGbd_639c746a3072df212021-07-02 · +3dVerified

Name: Handi Quilter
norm: handi quilter
Domain: handiquilter.com

Name: Handi Quilter
norm: handi quilter
Domain: handiquilter.com
Industry: Retail & Consumerllm

Discovered: Jun 28, 2021
Breach occurred: Mar 24, 2020 – Apr 29, 2021
Undetected for: 461 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 29, 2021
Affected individuals: 3,096state + nationwide
Data types: Identity (basic)Financial account
Data elements: Financial account number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Offered 12 Months of Daily Credit Monitoring Provided by Transunion
Offered identity restoration assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: ME AG ≤30d · 1d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 28, 2021
→ Filed with AG: Jun 29, 2021
1d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 28, 2021 → Filed with AG: Jun 29, 2021	1d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 29 · first

Massachusetts State AGJun 29 · first

Montana State AGJun 29 · first

Maine State AGJun 29 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1a768d61-844c-4029-9731-33d6ea07bc19.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2021
Raw hash: 4bba55ec81284cee4df546170b878cbe1bcff7eb1155eabb3b857b9cee66dda6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHandi Quilter

Victim entityHandi Quilter

Incidentdiscovered Jun 28, 2021

Stated responseSent written notification to affected consumers

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov