HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedTargetedPCIFinancial accountIdentity (basic)LowActive

HairBow Center

bd_ece37997c585b80f · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 26, 2018

Filed

Oct 26, 2018

To disclose

4 weeks

Affected

4state residents only

Linked

2 filings

Confidence

66%

Full breach record for HairBow Center →

Hairbow Center, LLC notified the NH AG of a data security incident involving a third-party vendor, Shopper Approved, LLC. A malicious actor modified code on Shopper's system to capture payment card info from Hairbow's website between Sept 15-17, 2018. Hairbow learned of the incident on Sept 26, 2018. Four NH residents were notified.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 4 weeks / 30 days

Sep 15, 2018

Begins

Sep 26, 2018

Discovered

Oct 26, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Part of Shopper Approved, LLC supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_342ef5eccb7a24f12018-10-26Verified

Name: HairBow Center
norm: hairbow center
Domain: hairbowcenter.com

Name: HairBow Center
norm: hairbow center
Domain: hairbowcenter.com
Industry: Retail & Consumerllm

Discovered: Sep 26, 2018
Breach occurred: Sep 15, 2018 – Sep 17, 2018
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 19, 2018
Affected individuals: 4state-resident count only
Data types: PCIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input CaptureT1071 Application Layer Protocol
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: supply_chain

During the incident: Removed the Shopper seal from its website
Shopper removed the modified computer code
Shopper launched an investigation
Shopper engaged a leading cybersecurity investigation firm
Shopper contacted law enforcement
Changes made: Shopper is continuing to review and enhance the company’s security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 26 · first

New Hampshire State AGOct 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hairbow-center-20181026.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 26, 2018
Raw hash: 93955b8fbcaa46584cd9cf0857b9886562135bd376c3c7643613dbc544606fd1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHairBow Center

Victim entityHairBow Center

Incidentdiscovered Sep 26, 2018

Stated responseRemoved the Shopper seal from its website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov