HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Merchant One, Inc.

bd_feb24aac42208b29 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 24, 2020

Filed

Nov 30, 2020

To disclose

40 weeks

Affected

26state residents only

Linked

5 filings

Confidence

67%

Full breach record for Merchant One, Inc. →

Merchant One, Inc. notified the New Hampshire Attorney General on November 23, 2020, of a data event affecting 26 NH residents. On February 24, 2020, suspicious activity involving a third-party IT provider was detected. An unknown individual may have accessed files containing names, SSNs, driver's license numbers, and financial account info. Merchant One engaged forensic specialists, reviewed impacted files, and provided 1 year of Kroll credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 40 weeks / 280 days

Feb 24, 2020

Discovered

Nov 30, 2020

Filed

vs. sector median

+31 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0cd6828729bbce812020-11-23 · +7dVerified
Massachusetts State AGbd_1410d50c584653da2020-11-23 · +7dVerified
Maine State AGbd_6b85e9a03898bdae2020-11-23 · +7dCandidate
California State AGbd_e39d2ca718b315662020-11-23 · +7dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Merchant One, Inc.
norm: merchant one
Industry: Financial Servicesllm

Discovered: Feb 24, 2020
Materiality determined: —
Notification sent: Nov 23, 2020
Affected individuals: 26state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Launched an investigation
Working with third-party forensic specialists
Began a comprehensive review of the files
Worked with a vendor to assist with determining address information
Provided written notice of this incident to all affected individuals
Providing access to credit monitoring services for 1 year through Kroll
Changes made: Implementing additional safeguards and training to its employees
Implemented additional measures to further protect information, including enhanced email security, multi-factor authentication and additional training
Transitioned to utilizing a different IT provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(280 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGNov 23 · first

Massachusetts State AGNov 23 · first

Maine State AGNov 23 · first

California State AGNov 23 · first

New Hampshire State AG+7d · this page

Pattern: first filing Nov 23 (IN), last Nov 30 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/merchant-one-20201130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: 7b1eed7bfd62822a45d5ac7a9216ea33d57d991d19e087e44117f4ef6ef0de62

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityMerchant One, Inc.

Incidentdiscovered Feb 24, 2020

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov