HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

Mercedes-Benz of Wappingers Falls

bd_df698f42cfae0a20 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 13, 2020

Filed

Sep 10, 2020

To disclose

8 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Mercedes-Benz of Wappingers Falls →

Northwood Motors, LLC d.b.a Mercedes-Benz of Wappingers Falls notified the NH AG of a cyberattack on July 13, 2020. An unauthorized individual accessed the customer management system, viewing and removing data including driver's license information. One NH resident was notified on Sept 8, 2020. The company engaged forensic experts, notified the FBI, strengthened credentials, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Jul 13, 2020

Discovered

Sep 10, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c0296e41709870652020-09-11 · +1dVerified

Name: Northwood Motors, LLC
norm: northwood motors
Domain: northwood.edu

Name: Mercedes-Benz of Wappingers Falls
norm: mercedes benz of wappingers falls
Industry: Retail & Consumerllm

Discovered: Jul 13, 2020
Materiality determined: —
Notification sent: Sep 8, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Hired cybersecurity experts and a leading independent digital forensics firm to investigate the incident
Notified the FBI
Strengthened the user credentials for its customer management system
Offered impacted individual twelve (12) months of complimentary identity monitoring and identity protection services
Changes made: Strengthened the user credentials for its customer management system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 10 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northwood-motors-20200910.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 10, 2020
Raw hash: 018212b72a68aa4bfa2a5d9fab61ad7c5dec487d6b8b2d6a4d2464fdeb8d40b1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNorthwood Motors, LLC

Victim entityMercedes-Benz of Wappingers Falls

Incidentdiscovered Jul 13, 2020

Stated responseHired cybersecurity experts and a leading independent digital forensics firm to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov