HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)MediumContained

Historical Emporium, inc

bd_f5cb3043f44033e8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 21, 2019

Filed

Jun 4, 2019

To disclose

14 days

Affected

4,500scope not determined

Linked

2 filings

Confidence

66%

Full breach record for Historical Emporium, inc →

Historical Emporium, Inc. disclosed a data breach affecting approximately 4,500 customers. Malware was present on the company's payment-processing website from March 2, 2019, to May 21, 2019, stealing payment card numbers, names, billing addresses, and expiration dates. The company removed the malware, notified law enforcement and payment brands, and enhanced system security.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 21, 2019 → Notified May 31, 201910d ✓ CA 60-day OK14 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 80 days

discovery → filing · 14 days

Mar 2, 2019

Begins

May 21, 2019

Discovered

Jun 4, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_65951ba55a9416672019-06-07 · +3dVerified

Name: Historical Emporium, inc
norm: historical emporium
Domain: historicalemporium.com

Name: Historical Emporium, inc
norm: historical emporium
Domain: historicalemporium.com
Industry: Retail & Consumerllm

Discovered: May 21, 2019
Breach occurred: Mar 2, 2019 – May 21, 2019
Undetected for: 80 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 31, 2019
Affected individuals: 4,500scope not determined
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: reported the details of this breach to the payment card brands, as well as to law enforcement
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code and secure the affected part of our systems
Reported the details of this breach to the payment card brands, as well as to law enforcement
Changes made: Taken additional steps to enhance security and monitoring of sensitive systems
Identified the security gap that led to this breach, and have taken numerous steps to close this loophole and harden our website security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 60-day OK · 10d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 21, 2019
→ Notified: May 31, 2019
10d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 21, 2019 → Notified: May 31, 2019	10d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGJun 4 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-147827
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 4, 2019
Raw hash: 7c54f2b4b2b625067d1e01efc395b6ba5bc27a983966ad3359860566d1683da9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHistorical Emporium, inc

Victim entityHistorical Emporium, inc

Incidentdiscovered May 21, 2019

Stated responseRemoved the unauthorized code and secure the affected part of our systems

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov