HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataTargetedData ExfiltratedPIIIdentity (basic)CredentialsFinancial accountPCILowResolved

CoffeeAM

bd_05f806654fbce1a6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2019

Filed

Dec 6, 2019

To disclose

9 weeks

Affected

79state residents only

Confidence

64%

Full breach record for CoffeeAM →

CJGO Fulfillment, Inc. DBA CoffeeAM notified customers of a data security incident where an unauthorized third party injected a malicious script into the website checkout page between January 16 and October 2, 2019. The script potentially captured names, addresses, emails, passwords, and payment card information. The company removed the script, restored systems, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 258 days

discovery → filing · 9 weeks / 66 days

Jan 16, 2019

Begins

Oct 1, 2019

Discovered

Dec 6, 2019

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed79 affectedView incident

Name: CoffeeAM
norm: coffeeam

Name: CoffeeAM
norm: coffeeam
Also named: CJGO Fulfillment, Inc.dba oflegal entity
CoffeeAMdba oftrade name
Industry: Retail & Consumerllm

Discovered: Oct 1, 2019
Breach occurred: Jan 16, 2019 – Oct 2, 2019
Undetected for: 258 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 9, 2019
Affected individuals: 79state-resident count only
Data types: PIIIdentity (basic)CredentialsFinancial accountPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Relevant payment card brands (Visa, MasterCard, American Express, and Discover) are aware of this incident
Initial access: exploit_public_facing

During the incident: Identified and eliminated a malicious script on the checkout page
Fully restored systems
Implemented heightened security in the checkout process
Offered identity theft protection services through ID Experts
Changes made: Implemented heightened security in the checkout process
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notice-63.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2019
Raw hash: 77856fcb417d5451dd7f97a1eea192c0455b4214c3369098f986fa19b744b93c

Reporting entityCoffeeAM

Victim entityCoffeeAM

Incidentdiscovered Oct 1, 2019

Stated responseIdentified and eliminated a malicious script on the checkout page

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov