AccidentalMisconfigurationData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICPIILowActive
Gapbuster Worldwide Pty Ltd
bd_052327572fa08ab5 · schema v1 · pii pii-v1
Full breach record for Gapbuster Worldwide Pty Ltd →Gapbuster Worldwide Pty Ltd (GBW) notified the Idaho Attorney General on June 4, 2024, regarding a data breach involving its third-party vendor, Nectar Desk. On May 30, 2024, GBW discovered that personal data of 140 independent contract employees (names, emails, mobile numbers, login details, shopper codes) was exposed on public AWS S3 storage due to Nectar's misconfigured storage policy. GBW notified Nectar, who contained the incident. GBW is notifying affected individuals and regulators.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_085bfdee92dbd5d4New Hampshire State AGfiled 2024-06-04Verified
- bd_a85b7e063d378f4eCalifornia State AGfiled 2024-06-04Verified
- bd_9e297168849119baMaine State AGfiled 2024-06-05(1d gap)Verified
- bd_3f82215f16bf076fVermont State AGfiled 2024-06-02(2d gap)Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2024/06/06-04-2024-Gapbuster-Worldwide-Pty-Ltd.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 4, 2024
- Raw hash
- d24fb8c29182b75c85e079a85f38e46cb60ce5f8fd69c04d896166fefd1678b3
Reporting entity
- Name
- Gapbuster Worldwide Pty Ltdnorm: gapbuster worldwide
- Domain
- gbw.solutions
Victim entity
- Name
- Gapbuster Worldwide Pty Ltdnorm: gapbuster worldwide
- Domain
- gbw.solutions
Incident
- Discovered
- May 30, 2024
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 140
- Data types
- IDENTITY_BASICPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1530 Data from Cloud Storage Object
- Threat actor
- Partner
- Regulator citations
- Notification to the supervising authorities of other demographics have been notified
- Third party
- via Nectar Desk
- Initial access
- supply_chain
Compliance
- Time to disclose
- 4 days(4 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.