HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsHighContained

Pentel of America, Ltd.

bd_f6d59a7e13766dd7 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 20, 2009

Filed

Mar 3, 2009

To disclose

6 weeks

Affected · nationwide

2,0767 in this filing

Confidence

65%

Pentel of America, Ltd. reported a cybersecurity incident involving its online retail outlet (www.pentelstore.com). Unidentified actors gained unauthorized access between December 11, 2008, and January 20, 2009, accessing personal data of online shoppers, including names, billing addresses, email addresses, phone numbers, credit card numbers, expiration dates, and CV2 codes. An estimated 2,076 individuals were affected, including 7 New Hampshire residents. Pentel notified the New Hampshire Attorney General, engaged law enforcement (Grapevine PD and U.S. Secret Service), retained Kroll Inc. for credit monitoring services, and mailed notification letters to affected individuals starting February 19, 2009.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 40 days

discovery → filing · 6 weeks / 42 days

Dec 11, 2008

Begins

Jan 20, 2009

Discovered

Mar 3, 2009

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,076 affectedView incident

Name: Pentel of America, Ltd.
norm: pentel of america
Domain: pentelworld.com

Name: Pentel of America, Ltd.
norm: pentel of america
Domain: pentelworld.com
Industry: Retail & Consumerllm

Discovered: Jan 20, 2009
Breach occurred: Dec 11, 2008 – Jan 20, 2009
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2009
Affected individuals: 2,076state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General, Consumer Protection and Antitrust Bureau of New HampshireReferred the case to the Network Intrusion Division of the U.S. Secret Service Cyber Crimes Unit
Initial access: exploit_public_facing

During the incident: Reported the unauthorized website access incident to the Grapevine Police Department (GPD) in Grapevine, Texas
GPD referred the case to the Network Intrusion Division of the U.S. Secret Service Cyber Crimes Unit
Retained Kroll Inc. for notification, hotline access, credit monitoring, and identity theft restoration services for one year
Notified all affected individuals of the online data security incident by written letter through first-class mail, postage prepaid, the mailing of which began on February 19, 2009
Changes made: Moving the location of our online retail outlet website
Implementing strong passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pentel-america-20090303.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2009
Raw hash: ff1bebfc51695abeff8ff114de386513bc2d50e7ad1ea984ec2bb4769cd2135f

Reporting entityPentel of America, Ltd.

Victim entityPentel of America, Ltd.

Incidentdiscovered Jan 20, 2009

Stated responseReported the unauthorized website access incident to the Grapevine Police Department (GPD) in Grapevine, Texas

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov