Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Financial accountPIILowActive

Lasko Group, Inc.

bd_f5b3ac1b6348b98b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 2, 2014

Filed

Jul 30, 2014

To disclose

28 days

Affected

87state residents only

Linked

3 filings

Confidence

66%

Full breach record for Lasko Group, Inc. →

Lasko Group, Inc. notified the NH AG of a phishing attack targeting customers who made online parts purchases. Unauthorized access occurred between Dec 2011 and June 2014. 87 NH residents' names, emails, phone numbers, and credit card details were potentially exposed. Lasko engaged forensic experts and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 944 days

discovery → filing · 28 days

Dec 1, 2011

Begins

Jul 2, 2014

Discovered

Jul 30, 2014

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_a052370da10ed8412014-07-30Candidate
Massachusetts State AGbd_a7099c9ab796b03a2014-08-04 · +5dVerified

Name: Lasko Group, Inc.
norm: lasko group

Name: Lasko Group, Inc.
norm: lasko group
Industry: Retail & Consumerllm

Discovered: Jul 2, 2014
Breach occurred: Dec 1, 2011 – Jun 30, 2014
Undetected for: 944 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2014
Affected individuals: 87state-resident count only
Data types: Identity (basic)Financial accountPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProvided written notice to other state regulatorsNotified national credit reporting agencies
Initial access: phishing_link

During the incident: Launched an internal investigation
Retained external, nationally recognized computer forensics experts
Provided written notice to affected individuals
Offered access to one (1) free year of credit/identity monitoring and identity theft restoration services
Provided written notice to other state regulators and to the national credit reporting agencies
Changes made: Arranged to have AllClear ID protect your identity for one year at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGJul 30 · first

New Hampshire State AGJul 30 · first · this page

Massachusetts State AG+5d

Pattern: first filing Jul 30 (CA), last Aug 4 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lasko-group-20140730.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2014
Raw hash: 6ef09a9960be11a1f800022bd95fa8f080d06485395747ad3884e335e5e37bd0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLasko Group, Inc.

Victim entityLasko Group, Inc.

Incidentdiscovered Jul 2, 2014

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov