HackingRetail & ConsumerRetailCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)CredentialsLowContained

North 40 Outfitters

bd_e64ead328d32d972 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2018

Filed

Feb 14, 2019

To disclose

14 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for North 40 Outfitters →3 incidents on file

North 40 Outfitters disclosed that customer credit and debit card information, including names, card numbers, expiration dates, and CVVs, may have been subject to unauthorized access on its e-commerce website between February 2, 2018, and November 20, 2018. The incident was discovered on November 8, 2018, via suspicious activity monitoring. North 40 engaged a third-party forensic firm, contained the incident, and notified affected individuals and regulators in February 2019. No retail store transactions were affected.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 279 days

discovery → filing · 14 weeks / 98 days

Feb 2, 2018

Begins

Nov 8, 2018

Discovered

Feb 14, 2019

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_4b668a3582761b702019-02-14Candidate
Washington State AGbd_91ec3d5509abff2e2019-02-14Verified by operator
Oregon State AGbd_9f6005ba312469512019-02-14Verified
Massachusetts State AGbd_b52d773a93fb37ee2019-02-14Verified

Show 2 more filings ↓up to 74d gap

New Hampshire State AGbd_c382d77b4fab019c2019-02-19 · +5dVerified
New Hampshire State AGbd_413daf193a69e1642019-04-29 · +74dVerified

Name: North 40 Outfitters
norm: north 40 outfitters

Name: North 40 Outfitters
norm: north 40 outfitters
Industry: Retail & Consumerllm

Discovered: Nov 8, 2018
Breach occurred: Feb 2, 2018 – Nov 20, 2018
Undetected for: 279 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 14, 2019
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Provided written notice to the California Attorney GeneralProviding written notice to other state regulators

During the incident: Launched an investigation with the assistance of a third-party forensic firm
Provided notice to individuals whose credit and debit cards were used on their e-commerce website during the relevant period
Providing all impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Providing information on protecting against tax fraud
Providing the contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Reminding individuals to remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports
Encouraging individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud
Reported this incident to the credit card companies
Providing written notice of this incident to other state regulators and the consumer reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Continuing to monitor its e-commerce environment to guard against suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Montana State AGFeb 14 · first

Washington State AGFeb 14 · first

Oregon State AGFeb 14 · first

Massachusetts State AGFeb 14 · first

California State AGFeb 14 · first · this page

New Hampshire State AG+5d

New Hampshire State AG+74d

Pattern: first filing Feb 14 (MT), last Apr 29 (NH) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144716
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2019
Raw hash: f2eb266ec83fbeec149c1111c1838f0c3335abe7c3e28f49cd7e11fe81a2656d

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNorth 40 Outfitters

Victim entityNorth 40 Outfitters

Incidentdiscovered Nov 8, 2018

Stated responseLaunched an investigation with the assistance of a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov