HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowActive

Plow and Hearth, LLC

bd_e376fd98098c251e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2017

Filed

Sep 22, 2017

To disclose

7 weeks

Affected

116state residents only

Confidence

64%

Full breach record for Plow and Hearth, LLC →2 incidents on file

Plow & Hearth, LLC notified the NH Attorney General of a third-party data breach involving its e-commerce platform provider, Aptos, Inc. Unauthorized access occurred between July 22 and August 9, 2017, exposing consumer names, addresses, phone numbers, and payment card details (including CVVs). 116 NH residents were affected. Notices were sent in late September 2017. The FBI was notified, and the investigation was ongoing at the time of filing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 10 days

discovery → filing · 7 weeks / 52 days

Jul 22, 2017

Begins

Aug 1, 2017

Discovered

Sep 22, 2017

Filed

vs. sector median

1 wks faster

Part of Aptos supply-chain incident (2017) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed116 affectedView incident

Name: Plow and Hearth, LLC
norm: plow and hearth

Name: Plow and Hearth, LLC
norm: plow and hearth
Industry: Retail & Consumerllm

Discovered: Aug 1, 2017
Breach occurred: Jul 22, 2017 – Aug 9, 2017
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2017
Affected individuals: 116state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via Aptos, Inc.
Initial access: exploit_public_facing

During the incident: Reported matter to the FBI
Investigation is ongoing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/plow-hearth-20170922.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2017
Raw hash: b0e5f37a94eadc06e9845e3f7ca52e83cfb1a80b2a4ae84b14489837fc44eb29

Reporting entityPlow and Hearth, LLC

Victim entityPlow and Hearth, LLC

Incidentdiscovered Aug 1, 2017

Stated responseReported matter to the FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov