MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

LÍLLÉbaby

bd_ec62da6a823fbd40 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2018

Filed

Aug 29, 2018

To disclose

13 weeks

Affected

177state residents only

Linked

5 filings

Confidence

66%

Full breach record for LÍLLÉbaby →

LÍLLÉbaby notified the NH AG of a malware incident on its e-commerce platform affecting customer payment card data (names, numbers, expirations, CVVs) from June 2016 to July 2018. 177 NH residents affected. Notifications sent Aug 28, 2018. Forensics engaged, FBI notified, platform security enhanced.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 730 days

discovery → filing · 13 weeks / 89 days

Jun 1, 2016

Begins

Jun 1, 2018

Discovered

Aug 29, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_42f139649d2cf0362018-08-29Verified
Oregon State AGbd_e6bf067828ae30522018-08-29Candidate
Washington State AGbd_f000fce9dfaaaa232018-08-29Verified
California State AGbd_f92a306617ed7da42018-08-29Verified

Name: LÍLLÉbaby
norm: lillebaby
Domain: lillebaby.com

Name: LÍLLÉbaby
norm: lillebaby
Domain: lillebaby.com
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Jun 1, 2016 – Jul 9, 2018
Undetected for: 730 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 28, 2018
Affected individuals: 177state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated CollectionT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Retained a leading forensics firm to determine what happened
Reported the matter to the Federal Bureau of Investigation (“FBI”)
Reported the matter to the payment card brands
Changes made: Working with a leading forensics firm to remove malicious code from the LÍLLÉbaby e-commerce web platform
Increased the security of its e-commerce platform (Magento)
Transitioned to processing payment cards through Payflow Pro IFrame
Rebuilding its web platform in order to enhance the security of the payment card environment
Offering identity monitoring services for twelve (12) months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 29 · first

Oregon State AGAug 29 · first

Washington State AGAug 29 · first

California State AGAug 29 · first

New Hampshire State AGAug 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lillebaby-20180829.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2018
Raw hash: 1fc524259d152617ba2d8f3b1e8f2e4e73a08eee8cc55a72bd05c826481500e0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLÍLLÉbaby

Victim entityLÍLLÉbaby

Incidentdiscovered Jun 1, 2018

Stated responseRetained a leading forensics firm to determine what happened

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov