HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Hospitality Furnishings & Design

bd_e72fb24bf96afca0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 21, 2021

Filed

Jun 1, 2022

To disclose

32 weeks

Affected

1state residents only

Linked

4 records

Confidence

66%

Full breach record for Hospitality Furnishings & Design →

Hospitality Furnishings and Design, Inc. notified Montana residents of a security incident discovered on October 21, 2021. An unauthorized actor accessed internal systems and potentially acquired personal information including names. The company engaged forensic specialists, enhanced policies, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d32 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 32 weeks / 223 days

Oct 21, 2021

Discovered

Jun 1, 2022

Filed

vs. sector median

+22 wks slower

This filing is one of 4 records about the same incident.View merged incident

A leak claim by suncrypt about this victim was first seen 194 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesuncryptbd_adb9fea9f5e4f6392021-11-19 · +194dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_3594d467cbbf27fb2022-06-01Verified
Massachusetts State AGbd_d641a7a402e3397e2022-02-08 · +113dVerified by operator

Name: Hospitality Furnishings & Design
norm: hospitality furnishings design

Name: Hospitality Furnishings & Design
norm: hospitality furnishings design
Industry: Retail & Consumerllm

Discovered: Oct 21, 2021
Materiality determined: —
Notification sent: Mar 15, 2022
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying state and federal regulators
Initial access: valid_credentials

During the incident: Took proactive steps to secure our network
Conducted an investigation with the assistance of third-party computer forensic specialists
Reviewing and enhancing existing policies and procedures
Notifying state and federal regulators
Offering complimentary access to one year of credit monitoring and identity theft restoration services through TransUnion
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(223 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 8 · first

Indiana State AG+113d

Montana State AG+113d · this page

Pattern: first filing Feb 8 (MA), last Jun 1 (MT) — a 113-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-353.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2022
Raw hash: 990930c4a10b1763fa2019d3cd1114bfd3052491077b34379c8843f107c8b6c4

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityHospitality Furnishings & Design

Victim entityHospitality Furnishings & Design

Incidentdiscovered Oct 21, 2021

Stated responseTook proactive steps to secure our network

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov