HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsFinancial accountFinancial credentialsLowContained

Free Speech Systems, LLC

bd_eef7599a5fc36033 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 13, 2018

Filed

Dec 17, 2018

To disclose

5 weeks

Affected

5state residents only

Linked

2 filings

Confidence

66%

Free Speech Systems, LLC notified the NH AG of a security incident where unauthorized code was added to its e-commerce site, copying payment card info (including CVVs) and customer PII. Incident occurred Nov 12-13, 2018; discovered Nov 13. 5 NH residents affected. Response included code removal, forensic investigation, password resets, and secure checkout migration.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 5 weeks / 34 days

Nov 12, 2018

Begins

Nov 13, 2018

Discovered

Dec 17, 2018

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_3d6b6c86e748f77f2018-12-14 · +3dVerified

Name: Free Speech Systems, LLC
norm: free speech systems
Domain: ofree.net

Name: Free Speech Systems, LLC
norm: free speech systems
Domain: ofree.net
Industry: Retail & Consumerllm

Discovered: Nov 13, 2018
Breach occurred: Nov 12, 2018 – Nov 13, 2018
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 14, 2018
Affected individuals: 5state-resident count only
Data types: Identity (basic)CredentialsFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data StagedT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code
Worked with a leading cyber security firm to investigate the incident
Reset affected customers' account passwords
Changes made: Moved to a more secure check-out method
Taking steps to strengthen the security of our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGDec 14 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/free-speech-20181217.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2018
Raw hash: 285915517bb04c8f09d1d376d4f4fa878e8a2b75e6a6aa3b978d1471a5c7118a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFree Speech Systems, LLC

Victim entityFree Speech Systems, LLC

Incidentdiscovered Nov 13, 2018

Stated responseRemoved the unauthorized code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov