HackingRetail & ConsumerRetailVulnerability ExploitTargetedData ExfiltratedIdentity (basic)Financial accountCredentialsAuthenticationLowActive

Honig's Whistle Stop

bd_e75f98e8f4afe072 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 5, 2016

Filed

Nov 9, 2016

To disclose

5 weeks

Affected

45state residents only

Linked

2 filings

Confidence

65%

Full breach record for Honig's Whistle Stop →

Honig's Whistle Stop, Inc. notified Montana residents of a data breach where a malicious file on its website captured customer data (names, credit card numbers, CVVs, passwords) entered between Aug 4-30, 2016. The breach was confirmed on Oct 5, 2016. The company engaged forensic investigators, notified the FBI, implemented security patches, tokenized card data, and provided one year of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 62 days

discovery → filing · 5 weeks / 35 days

Aug 4, 2016

Begins

Oct 5, 2016

Discovered

Nov 9, 2016

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_67c50f3aa9f459c92016-11-09Verified

Name: Honig's Whistle Stop
norm: honig s whistle stop

Name: Honig's Whistle Stop
norm: honig s whistle stop
Industry: Retail & Consumerllm

Discovered: Oct 5, 2016
Breach occurred: Aug 4, 2016 – Aug 30, 2016
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 1, 2016
Affected individuals: 45state-resident count only
Data types: Identity (basic)Financial accountCredentialsAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Contacted law enforcement (FBI)
Initial access: exploit_public_facing

During the incident: Immediately contacted law enforcement
Partnered with a leading third-party firm to conduct a thorough investigation
Implemented additional security measures designed to prevent a recurrence of the breach
Removing the malware and patching the security flaw
Re-issuing administrative credentials
Closely monitoring our website for any suspicious activity
Tokenization of all credit card data
Migrating the website to a new system hosted by a PCl-compliant third party specialist
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Tokenization of all credit card data so that even employees do not have access to customer credit card details
Migrating the website to a new system hosted by a PCl-compliant third party specialist
Transitioning to a third-party hosted payment system
Retaining an independent third party to complete its quarterly PCI scans
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGNov 9 · first

Montana State AGNov 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Honigs-Whistle-Stop.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2016
Raw hash: d55f56edd8e0101ee9715a90cbc0644d8f0065f7652935ec622a33f5ac7c3ddf

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHonig's Whistle Stop

Victim entityHonig's Whistle Stop

Incidentdiscovered Oct 5, 2016

Stated responseImmediately contacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov