HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedAuthenticationFinancial accountIdentity (basic)MediumActive

Made In Oregon

bd_fb58f1d5247467d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Jun 22, 2021

To disclose

29 weeks

Affected · nationwide

12,890840 in this filing

Linked

7 filings

Confidence

70%

Full breach record for Made In Oregon →3 incidents on file

Made In Oregon (Naito Corporation) reported unauthorized access to customer data (names, addresses, emails, credit cards) between Sept 2020 and Feb 2021. 12,890 total customers affected, including 840 in Washington. Investigation ongoing; forensic investigators hired, law enforcement notified, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d29 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 90 days

discovery → filing · 29 weeks / 204 days

Sep 1, 2020

Begins

Nov 30, 2020

Discovered

Jun 22, 2021

Filed

vs. sector median

+22 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_01d62431247fb74c2021-06-22Verified
New Hampshire State AGbd_81dd9834f8db446b2021-06-22Verified
South Carolina State AGbd_ba30aa9f4043b8e62021-06-23 · +1dVerified
California State AGbd_7efe2ddfcbdd679b2021-06-18 · +4dVerified

Show 2 more filings ↓up to 29d gap

Montana State AGbd_780ad110f3a857772021-06-16 · +6dCandidate
Oregon State AGbd_7d61036037d4cf672021-07-21 · +29dVerified

Name: Naito Corporation
norm: naito

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com
Industry: Retail & Consumerllm

Discovered: Nov 30, 2020
Breach occurred: Sep 1, 2020 – Feb 28, 2021
Undetected for: 90 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 22, 2021
Affected individuals: 12,890state + nationwide
Data types: Identity (basic)Financial account
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed reports of the incident with the US Secret Service and FBINotified the three national credit reporting agencies
Initial access: exploit_public_facing

During the incident: Hired a forensic investigator specializing in investigating website credit card compromises
Installed monitoring software on our website
Website was under 24/7 surveillance
Modified our website in February to stop accepting customer information
Filed reports of the incident with the US Secret Service and FBI
Notified the three national credit reporting agencies
Offering all potentially affected customers in your state two years of ID fraud and credit monitoring protection from Experian at no charge
Changes made: Current site will be replaced with different software on a different website host
Deploying a completely new website using different software running at a new website hosting company
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(204 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 16 · first

California State AG+2d

Indiana State AG+6d

New Hampshire State AG+6d

Washington State AG+6d · this page

South Carolina State AG+7d

Oregon State AG+35d

Pattern: first filing Jun 16 (MT), last Jul 21 (OR) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10725.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2021
Raw hash: c979aac43d4fbea644a2e77356bcc53393dc8dc7b809c1f7b9fd50553a060122

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityNaito Corporation

Victim entityMade In Oregon

Incidentdiscovered Nov 30, 2020

Stated responseHired a forensic investigator specializing in investigating website credit card compromises

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com