HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)LowContained

ROLAND DGA CORPORATION

bd_fe1b1588e4af7b70 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 16, 2024

Filed

Jul 24, 2024

To disclose

27 weeks

Affected

8state residents only

Linked

6 filings

Confidence

65%

Full breach record for ROLAND DGA CORPORATION →

Roland DGA Corporation notified New Hampshire AG of a security breach affecting its e-commerce store. Unauthorized code was present from July 26, 2023, to January 17, 2024, potentially capturing credit card transaction data. Approximately 8 NH residents were impacted. Roland DGA offered credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 174 days

discovery → filing · 27 weeks / 190 days

Jul 26, 2023

Begins

Jan 16, 2024

Discovered

Apr 22, 2024

Scope determined

Jul 24, 2024

Filed

vs. sector median

+20 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_3b60b701b8915b522024-07-24Verified
Maine State AGbd_8f33f77b85f1b5d82024-07-24Candidate
Indiana State AGbd_2cc4547461cd12f12024-07-19 · +5dVerified
Montana State AGbd_3c311867ae4848c52024-07-19 · +5dCandidate

Show 1 more filing ↓up to 5d gap

Vermont State AGbd_86dca0a9853e95662024-07-19 · +5dVerified

Name: ROLAND DGA CORPORATION
norm: roland dga

Name: ROLAND DGA CORPORATION
norm: roland dga
Industry: Retail & Consumerllm

Discovered: Jan 16, 2024
Breach occurred: Jul 26, 2023 – Jan 17, 2024
Undetected for: 174 daysoccurrence → discovery
Materiality determined: Apr 22, 2024
Notification sent: Jul 19, 2024
Affected individuals: 8state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Sana Commerce reset passwords associated with administrative accounts for the Roland DGA online store
Sana Commerce implemented additional security features to limit the potential for a similar incident occurring in the future
Roland DGA conducted a thorough analysis of transaction data
Roland DGA began confirming address information for potentially impacted individuals
Roland DGA notified potentially impacted individuals of this incident via First Class mail
Roland DGA is offering the potentially impacted residents of New Hampshire complimentary access to credit monitoring and identity protection services
Changes made: Sana Commerce implemented additional security features to limit the potential for a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(190 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGJul 19 · first

Montana State AGJul 19 · first

Vermont State AGJul 19 · first

Massachusetts State AG+5d

Maine State AG+5d

New Hampshire State AG+5d · this page

Pattern: first filing Jul 19 (IN), last Jul 24 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/roland-dga-20240724.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 24, 2024
Raw hash: d5b4c29f97d4e883c1d6e08da95842d733a44b1d583ddd4c5801bdec1225a9ea

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityROLAND DGA CORPORATION

Victim entityROLAND DGA CORPORATION

Incidentdiscovered Jan 16, 2024

Stated responseSana Commerce reset passwords associated with administrative accounts for the Roland DGA online store

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov