HackingRetail & ConsumerTechnologyRetailStolen CredentialsCapture Stored DataData ExfiltratedTargetedPIIIdentity (basic)Financial accountAuthenticationLowContained

Rand McNally

bd_e46d73878171e112 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 28, 2017

Filed

May 5, 2017

To disclose

9 weeks

Affected

48state residents only

Linked

4 filings

Confidence

65%

Rand McNally notified customers of a data breach affecting e-commerce transactions between April 2016 and March 2017. Suspicious activity was detected on February 28, 2017. Malware was installed to capture credit card data, CVVs, and personal info. The company engaged forensic investigators, removed malware, and offered one year of Experian identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 322 days

discovery → filing · 9 weeks / 66 days

Apr 12, 2016

Begins

Feb 28, 2017

Discovered

May 5, 2017

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_04d21df1ad5ac6282017-05-05Candidate
Oregon State AGbd_0c088de827cae2942017-05-05Verified
New Hampshire State AGbd_edbe2f6d86d762892017-05-05Verified

Name: Rand McNally
norm: rand mcnally

Name: Rand McNally
norm: rand mcnally
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Feb 28, 2017
Breach occurred: Apr 12, 2016 – Mar 2, 2017
Undetected for: 322 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 2, 2017
Affected individuals: 48state-resident count only
Data types: PIIIdentity (basic)Financial accountAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: reporting to the appropriate agencies
Initial access: exploit_public_facing

During the incident: Began investigating the server and removed the malware to prevent any further potential access
Worked with leading cyber investigators to determine what happened and what information may be affected
Reporting to the appropriate agencies
Fully cooperating with them
Notifying those who may be affected as they are identified
Offering 1 year of complimentary identity monitoring and identity restoration services through Experian
Changes made: Removed the malware
Offering 1 year of complimentary identity monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGMay 5 · first

Oregon State AGMay 5 · first

New Hampshire State AGMay 5 · first

Montana State AGMay 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/RM-Acquisition-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2017
Raw hash: d0cde1d965bed344982b4bbd578c76b64ede5b54925d6e5cde7b0eb345d7b62d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRand McNally

Victim entityRand McNally

Incidentdiscovered Feb 28, 2017

Stated responseBegan investigating the server and removed the malware to prevent any further potential access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov