Nordace Limited

Nordace Limited d/b/a Nordace reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-10-22. The reporting organization type is Other Commercial. 11 Vermont residents were affected. Categories of data breached: Financial Account Codes, Credit and Debit Account Info.

Nordace Limited, an online retailer of travel bags, identified unauthorized code (a skimming script) on its website checkout page on September 17, 2026. The code was inserted between August 2 and August 4, 2026, and was capable of capturing payment card details, names, and addresses. Nordace has not confirmed if data was actually exfiltrated. Approximately 13 New Hampshire residents were potentially affected. Nordace removed the code, reset credentials, implemented MFA, and notified law enforcement and regulators. The investigation into the initial access vector is ongoing.

Nordace Limited notified Massachusetts residents of a data security incident affecting its website (nordace.com) between August 2, 2026, and September 17, 2026. The incident involved the potential capture of checkout data, including names, addresses, email, phone numbers, payment card numbers, expiration dates, and CVV codes. Nordace identified and addressed the incident on September 17, 2026. The company has contained the incident, strengthened security controls, and notified law enforcement and regulators. No Social Security numbers or health information were involved.