HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountPIILowContained

Iron Horse Bicycle Classic

bd_dd767d3e3e49097d · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2013

Filed

Apr 25, 2013

To disclose

11 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Iron Horse Bicycle Classic →

Iron Horse Bicycle Classic notified the NH AG of a breach affecting 2 NH residents. Unauthorized access occurred as early as Nov 30, 2012, via a sophisticated attack on a shared web server. Data accessed included names, addresses, and credit card info. Notifications sent Feb 14, 2013. Investigation ongoing with FBI and local police.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 72 days

discovery → filing · 11 weeks / 74 days

Nov 30, 2012

Begins

Feb 10, 2013

Discovered

Apr 25, 2013

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8614c43cb5e4b51b2013-04-26 · +1dVerified

Name: Iron Horse Bicycle Classic
norm: iron horse bicycle classic
Domain: ironhorsebicycleclassic.com

Name: Iron Horse Bicycle Classic
norm: iron horse bicycle classic
Domain: ironhorsebicycleclassic.com
Industry: Retail & Consumerllm

Discovered: Feb 10, 2013
Breach occurred: Nov 30, 2012
Undetected for: 72 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2013
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Attorney GeneralWorking with the Durango, Colorado Police DepartmentWorking with the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Iron Horse immediately conducted an investigation into the circumstances surrounding the acquisition by the unauthorized individuals
Iron Horse has been working with the Durango, Colorado Police Department and the Federal Bureau of Investigation to catch the perpetrators of this attack
Iron Horse notified the New Hampshire residents whose personal information may have been accessed of the breach via email and by posting the same notice on its website
Iron Horse has changed its payment processing system in an attempt to prevent such unauthorized access in the future
Our web service provider re-installed the server container on March 1, 2013
We have changed the way that payment processing occurs to have payment collected by a hosted solution provided by Mercury Payments
Changes made: Changed its payment processing system in an attempt to prevent such unauthorized access in the future
Our web service provider re-installed the server container on March 1, 2013
Changed the way that payment processing occurs to have payment collected by a hosted solution provided by Mercury Payments
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 25 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/iron-horse-20130425.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 25, 2013
Raw hash: e0a00d0a4ceabc82cc8b6fdc3b033fae79d74905b3bb230219b999627af16dcc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityIron Horse Bicycle Classic

Victim entityIron Horse Bicycle Classic

Incidentdiscovered Feb 10, 2013

Stated responseIron Horse immediately conducted an investigation into the circumstances surrounding the acquisition by the unauthorized individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov