MalwareTechnologyProfessional ServicesInformationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedTargetedIdentity (basic)Financial accountFinancial credentialsLowContained

Targeted Victory

bd_f2cb486cc8ae6cb5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 5, 2016

Filed

Nov 17, 2016

To disclose

6 weeks

Affected · nationwide

5033 in this filing

Confidence

67%

Full breach record for Targeted Victory →2 incidents on file

Targeted Victory, LLC notified New Hampshire AG of a Magecart skimming attack on the NRSC online store (store.nrsc.org) on Oct 5, 2016. 503 individuals affected (3 in NH). Stolen data included names, payment card details, and PII. Site removed from Magento; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Oct 5, 2016

Discovered

Nov 17, 2016

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed503 affectedView incident

Name: Targeted Victory
norm: targeted victory
Domain: targetedvictory.com

Name: Targeted Victory
norm: targeted victory
Domain: targetedvictory.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: Oct 5, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 503state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Shutting down the site and removing it from Magento’s platform
Contracted with CSID to provide one year of CSID Protector services
Sent a notification letter via mail to all New Hampshire residents potentially affected
Changes made: Magento will not be used on any Targeted Victory or NRSC site moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/targeted-victory-20161117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2016
Raw hash: 80a4374cd7d622da9632866e3c40655e25dd16a96a002f0349d40b814a6c6692

Reporting entityTargeted Victory

Victim entityTargeted Victory

Incidentdiscovered Oct 5, 2016

Stated responseShutting down the site and removing it from Magento’s platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov