HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Nordace Limited

bd_dc99c6b699e47c92 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 17, 2026

Filed

Oct 1, 2026

To disclose

—

Affected

77state residents only

Linked

3 filings

Confidence

68%

Full breach record for Nordace Limited →

Nordace Limited notified Massachusetts residents of a data security incident affecting its website (nordace.com) between August 2, 2026, and September 17, 2026. The incident involved the potential capture of checkout data, including names, addresses, email, phone numbers, payment card numbers, expiration dates, and CVV codes. Nordace identified and addressed the incident on September 17, 2026. The company has contained the incident, strengthened security controls, and notified law enforcement and regulators. No Social Security numbers or health information were involved.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

Aug 2, 2026

Begins

Sep 17, 2026

Discovered

Oct 1, 2026

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_28e0f53e1bbad3492026-10-21 · +20dCandidate
Vermont State AGbd_e1deff704f46bf4e2026-10-22 · +21dVerified

Name: Nordace Limited
norm: nordace
Domain: nordace.com

Name: Nordace Limited
norm: nordace
Domain: nordace.com
Industry: Retail & Consumerllm

Discovered: Sep 17, 2026
Breach occurred: Aug 2, 2026 – Sep 17, 2026
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 77state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notifying the relevant regulators, including the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation
Initial access: exploit_public_facing

During the incident: Taken steps to contain the incident
Notified our payment processor
Strengthened the security controls protecting our checkout environment
Reported the incident to law enforcement
Notifying the relevant regulators, including the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation
Changes made: Strengthened the security controls protecting our checkout environment
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 1 · first · this page

New Hampshire State AG+20d

Vermont State AG+21d

Pattern: first filing Oct 1 (MA), last Oct 22 (VT) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1827-nordace-limited-doing-business-as-nordace/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2026
Raw hash: fbb4f19a2891fad7a184015bb4451adedfb0e19fd25edb746c708d051e388aef

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNordace Limited

Victim entityNordace Limited

Incidentdiscovered Sep 17, 2026

Stated responseTaken steps to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov