HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountLowActive

Apple Leisure Group

bd_ea4deee66ba2caf7 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 6, 2014

Filed

Dec 15, 2014

To disclose

32 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Apple Leisure Group →

Apple Leisure Group notified the NH AG of a data security event affecting one NH resident. Suspicious credit card activity reported May 6, 2014. Unauthorized access to name, address, credit card, phone, email, and DOB possible. Vendor involved. Remediation: process changes, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 223 days

May 6, 2014

Discovered

Dec 15, 2014

Filed

vs. sector median

+24 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_48d17a976a120bfb2014-12-15Candidate

Name: Apple
norm: apple
Domain: apple.com

Name: Apple Leisure Group
norm: apple leisure
Industry: Retail & Consumerllm

Discovered: May 6, 2014
Materiality determined: —
Notification sent: Dec 15, 2014
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided written notice to other state regulators, international regulators, and national consumer reporting agencies
Initial access: valid_credentials

During the incident: Retained third-party forensic experts to assist with the investigation
Notified its online booking vendor
Changed its processes so that access to credit card information is no longer possible
Sent written notice to the affected individual
Offered one year of credit monitoring services and identity restoration services
Provided written notice to other state regulators, international regulators, and national consumer reporting agencies
Changes made: Changed its processes so that access to credit card information is no longer possible
Reviewing its processes and enhancing its policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(223 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

New Hampshire State AGDec 15 · first

New Hampshire State AGDec 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/apple-leisure-group-20141215.pdf.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2014
Raw hash: 7a75615a46a598878c94551feeeb98e62b90ca317f60160543ca8b410e65d38e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityApple

Victim entityApple Leisure Group

Incidentdiscovered May 6, 2014

Stated responseRetained third-party forensic experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov