AccidentalMisconfigurationData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Outdoor Smart! Inc
bd_f53a3a1268dc51f0 · schema v1 · pii pii-v1
Full breach record for Outdoor Smart! Inc →OutdoorSmart! Inc. notified the NH Attorney General of a data event affecting 31 NH residents. Unauthorized code on the Campfire Collective website captured payment card info (names, card numbers, CVC) between Feb 15, 2024, and Nov 4, 2025. The code was removed Nov 4, 2025. Notices were sent Dec 19, 2025, offering 24 months of credit monitoring.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_3168f9850d26a5b3Washington State AGfiled 2025-12-19(3d gap)Candidate
- bd_6c6eccc5335561c3Maine State AGfiled 2025-12-19(3d gap)Verified
- bd_c828eb1df170a599California State AGfiled 2025-12-19(3d gap)Verified
- bd_e9416fffa56fe7ebVermont State AGfiled 2025-12-19(3d gap)Verified
Show 2 more filings ↓Show fewer ↑up to 16d gap
- bd_fe40f045ec9e37c2Indiana State AGfiled 2025-12-19(3d gap)Verified
- bd_8e546bbf2f313013Texas State AGfiled 2026-01-07(16d gap)Verified by operator
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/outdoorsmart-campfire-collectibles-20221222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 22, 2025
- Raw hash
- c00796e1ff9312aef164b9424c56cc1ce0a403570ed4280488fad16411e4e08b
Reporting entity
- Name
- GOODWIN PROCTER LLPnorm: goodwin procter
- Domain
- goodwinlaw.com
Victim entity
- Name
- Outdoor Smart! Incnorm: outdoor smart
Incident
- Discovered
- Nov 3, 2025
- Materiality determined
- —
- Notification sent
- Dec 19, 2025
- Affected individuals
- 31
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(49 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.