HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedPIICredentialsFinancial accountLowContained

Plant Therapy

bd_f8f71ff026792fff · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 20, 2018

Filed

Jul 30, 2018

To disclose

10 days

Affected

144state residents only

Linked

6 filings

Confidence

66%

Plant Therapy notified Montana residents of a data security incident discovered on July 20, 2018, involving its e-commerce platform. The incident potentially exposed names, usernames, passwords, and payment card details. The company reset passwords, engaged forensic investigators, and reported the incident to the FBI and payment card brands. Affected individuals were offered 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 days

Jul 20, 2018

Discovered

Jul 30, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_001ef817a39f7b6d2018-07-30Verified
Montana State AGbd_38c797e4e7408ca32018-07-30Verified
HHS OCRbd_799993f34d0de7d62018-07-30Verified
New Hampshire State AGbd_911dab7665ebb5b62018-07-30Verified

Show 1 more filing ↓

California State AGbd_fb9da4101eacad042018-07-30Verified

Name: Plant Therapy
norm: plant therapy
Domain: unitypoint.org

Name: Plant Therapy
norm: plant therapy
Domain: unitypoint.org
Industry: Retail & Consumerllm

Discovered: Jul 20, 2018
Materiality determined: —
Notification sent: Sep 12, 2018
Affected individuals: 144state-resident count only
Data types: PIICredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported the incident to the Federal Bureau of Investigationreported the matter to the payment card brands
Initial access: exploit_public_facing

During the incident: Resetting all passwords on our platform
Launched an investigation
Worked with a leading forensics firm
Reported the incident to the Federal Bureau of Investigation
Reported the matter to the payment card brands
Arranged to have AllClear ID protect your identity for 24 months
Changes made: Enhanced the security of Plant Therapy customer information and our e-commerce web platform
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 30 · first

Montana State AGJul 30 · first

HHS OCRJul 30 · first

New Hampshire State AGJul 30 · first

California State AGJul 30 · first

Montana State AGJul 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Plant-Therapy.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2018
Raw hash: d5bf77a38cb5102210fea92ccd0e9ee6ef78958eaf46982f19596f16bc4257e7

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPlant Therapy

Victim entityPlant Therapy

Incidentdiscovered Jul 20, 2018

Stated responseResetting all passwords on our platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov