HackingRetail & ConsumerRetailStolen CredentialsPhishingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountPCIMediumContained

Title Nine

bd_eb6c44c59aefbf5b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 25, 2018

Filed

Nov 13, 2018

To disclose

19 days

Affected

1,307state residents only

Linked

2 filings

Confidence

66%

Full breach record for Title Nine →6 incidents on file

Title Nine issued a supplemental notice to New Hampshire AG regarding a third-party vendor (Annex Cloud) compromise. Unauthorized code in the login app between Dec 2017 and July 2018 may have captured customer PII and payment card data. 1,307 NH residents notified starting Nov 12, 2018. Title Nine removed the vendor application.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 301 days

discovery → filing · 19 days

Dec 28, 2017

Begins

Oct 25, 2018

Discovered

Nov 13, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Part of Social Annex, Inc. supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_6fae6ea2118fad492018-11-12 · +1dCandidate

Name: Title Nine
norm: title nine
Domain: titlenine.com

Name: Title Nine
norm: title nine
Domain: titlenine.com
Industry: Retail & Consumerllm

Discovered: Oct 25, 2018
Breach occurred: Dec 28, 2017 – Jul 9, 2018
Undetected for: 301 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 12, 2018
Affected individuals: 1,307state-resident count only
Data types: Identity (basic)Financial accountPCI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: supply_chain

During the incident: Removed the Annex Cloud application from the website
Provided written notifications via United States Postal Service First-Class mail to affected residents
Continuing to take steps to strengthen the security of the website
Changes made: Removed the Annex Cloud application
Continuing to take steps to strengthen the security of the website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGNov 12 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/title-nine-20181113.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2018
Raw hash: a88da91875ee6396fee2c7a2fac5c9822d584b2ed0b57958c9ed3d90824f1187

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTitle Nine

Victim entityTitle Nine

Incidentdiscovered Oct 25, 2018

Stated responseRemoved the Annex Cloud application from the website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov