HackingOtherStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

The National Wildlife Federation

bd_e850d4465859eee1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 8, 2021

Filed

Mar 24, 2021

To disclose

11 weeks

Affected

1,255state residents only

Linked

10 filings

Confidence

66%

Full breach record for The National Wildlife Federation →2 incidents on file

The National Wildlife Federation notified South Carolina (and other states) that malicious code on Zoobooks.com compromised payment card data (name, address, card number, CVV) for customers between Feb 2019 and Dec 2020. Forensic specialists were retained. 319 Rhode Island residents were impacted; total count undisclosed.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 702 days

discovery → filing · 11 weeks / 75 days

Feb 6, 2019

Begins

Jan 8, 2021

Discovered

Mar 24, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_048b6a66df46475b2021-03-24Verified
Washington State AGbd_53218a1414a3fef42021-03-24Verified
California State AGbd_616fbe76043ab38a2021-03-24Verified
Maine State AGbd_b39ba2952a25d8d02021-03-24Verified

Show 5 more filings ↓up to 82d gap

Indiana State AGbd_c613edfbd878a4cf2021-03-24Verified
Oregon State AGbd_ddb6c4675f8bd76c2021-03-24Verified
Massachusetts State AGbd_f9847d799591af282021-03-24Verified
New Hampshire State AGbd_b0748f215ff0ea602021-03-29 · +5dVerified
Illinois State AGbd_1958b3ed86bc80ad2021-01-01 · +82dCandidate

Name: The National Wildlife Federation
norm: the national wildlife federation

Name: The National Wildlife Federation
norm: the national wildlife federation
Industry: Otherllm

Discovered: Jan 8, 2021
Breach occurred: Feb 6, 2019 – Dec 10, 2020
Undetected for: 702 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,255state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Retained third party computer forensic specialists
Worked with third-party vendors to immediately remediate this issue
Worked with its third-party vendors to further secure Zoobooks.com moving forward
Changes made: Reviewed its security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+82d

Washington State AG+82d

California State AG+82d

Maine State AG+82d

Indiana State AG+82d

Oregon State AG+82d

Massachusetts State AG+82d

South Carolina State AG+82d · this page

New Hampshire State AG+87d

Pattern: first filing Jan 1 (IL), last Mar 29 (NH) — a 87-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalWildlifeFederation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2021
Raw hash: 7d1587cf2eef481ea37d4985f3ec86696b84f2fcd9cb5a2bddaf61d8c3f4a422

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityThe National Wildlife Federation

Victim entityThe National Wildlife Federation

Incidentdiscovered Jan 8, 2021

Stated responseRetained third party computer forensic specialists

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov