HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowContained
National Baseball Hall of Fame and Museum
bd_e3d7da9eb448899e · schema v1 · pii pii-v1
Full breach record for National Baseball Hall of Fame and Museum →The National Baseball Hall of Fame and Museum experienced a data breach involving its web store (shop.baseballhall.org) between November 15, 2018, and May 14, 2019. An unauthorized third party placed malicious code on the e-commerce system, potentially accessing customer names, addresses, and credit/debit card information including CVV codes. The Hall retained forensic investigators, notified law enforcement, removed the code, and alerted credit card brands. No Social Security numbers or driver's licenses were impacted.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-149435
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 2, 2019
- Raw hash
- d7286ffc05a2bb0fe1271e77179d3ec70f3d00634d96f4d4c9582b9eb5482b97
Reporting entity
- Name
- National Baseball Hall of Fame and Museumnorm: national baseball hall of fame and museum
- Domain
- baseballhall.org
Victim entity
- Name
- National Baseball Hall of Fame and Museumnorm: national baseball hall of fame and museum
- Domain
- baseballhall.org
Incident
- Discovered
- Jun 18, 2019
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(45 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.