MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountCredentialsMediumContained

Manduka

bd_e4ba9d18c2b4acc5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 28, 2016

Filed

Oct 31, 2016

To disclose

5 weeks

Affected · nationwide

24,519118 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Manduka →3 incidents on file

Manduka notified the NH AG of a security incident where unauthorized individuals installed malicious software on its e-commerce platform (manduka.com). The incident affected approximately 24,519 US-based individuals (including 118 NH residents) who made purchases between Jan 29 and Oct 8, 2016. Compromised data included names, addresses, usernames, passwords, and payment card details. Manduka engaged forensic experts and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 243 days

discovery → filing · 5 weeks / 33 days

Jan 29, 2016

Begins

Sep 28, 2016

Discovered

Oct 31, 2016

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_809c47b45af988e92016-11-04 · +4dVerified

Name: Manduka
norm: manduka

Name: Manduka
norm: manduka
Industry: Retail & Consumerllm

Discovered: Sep 28, 2016
Breach occurred: Jan 29, 2016 – Oct 8, 2016
Undetected for: 243 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 31, 2016
Affected individuals: 24,519state + nationwide
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged outside forensic experts to assist in investigating and resolving the situation
Design and implement enhanced safeguards to strengthen the security of the manduka.com web platform
Changes made: Design and implement enhanced safeguards to strengthen the security of the manduka.com web platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 31 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/manduka-20161031.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 31, 2016
Raw hash: ea853dd0077585823baf70cb55fe7a1ca075f2d32b203f9df1d36cf6e86cc6ab

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityManduka

Victim entityManduka

Incidentdiscovered Sep 28, 2016

Stated responseEngaged outside forensic experts to assist in investigating and resolving the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov