HackingTechnologyInformationVulnerability ExploitCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Cruzstar LLC.

bd_e3c49a35cb6558d6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 28, 2017

Filed

Mar 6, 2018

To disclose

14 weeks

Affected

76state residents only

Linked

3 filings

Confidence

66%

Full breach record for Cruzstar LLC. →

Cruzstar LLC, a software company, notified the NH AG of a security incident where malware on its Desktop ordering site captured customer PII and payment card data (including CVV) from Nov 5-28, 2017. Discovered Nov 28, 2017. ~76 NH residents impacted. Merchants notified Feb 20, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 23 days

discovery → filing · 14 weeks / 98 days

Nov 5, 2017

Begins

Nov 28, 2017

Discovered

Mar 6, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_a05e25677a2f8d3c2018-03-02 · +4dCandidate
Massachusetts State AGbd_79bac6664d180ec62018-02-27 · +7dVerified

Name: Cruzstar LLC.
norm: cruzstar

Name: Cruzstar LLC.
norm: cruzstar
Industry: Technologyllm

Discovered: Nov 28, 2017
Breach occurred: Nov 5, 2017 – Nov 28, 2017
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 20, 2018
Affected individuals: 76state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: notified Federal law enforcement of the incident
Initial access: exploit_public_facing

During the incident: Began an investigation
Notified Federal law enforcement of the incident
Provided written notification to our New Hampshire restaurant merchants
Engaged a leading cybersecurity firm that assisted them with the investigation
Notified Federal law enforcement of the incident
Working closely with the major credit card brands
Changes made: Continuing to take steps to strengthen the security of our network
Using automated tools to help identify any suspicious activity
Actively working with leading security experts and law enforcement to strengthen the security of their network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 27 · first

California State AG+3d

New Hampshire State AG+7d · this page

Pattern: first filing Feb 27 (MA), last Mar 6 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cruzstar-20180306.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 6, 2018
Raw hash: 9888ea3b685a6408091cee2968e7cf32243d968f5a18fb4993e499126e7f7f71

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCruzstar LLC.

Victim entityCruzstar LLC.

Incidentdiscovered Nov 28, 2017

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov