HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
John and Kira's Chocolates
bd_093ec81b443b65cc · schema v1 · pii pii-v1
Full breach record for John and Kira's Chocolates →Aethera LLC dba John and Kiras, a POS vendor based in Philadelphia, PA, reported an external system breach (hacking) occurring between November 24, 2021, and July 1, 2022. The incident compromised the personal information and financial account numbers (including credit/debit card numbers with security codes/PINs) of 9,328 individuals, including 51 Maine residents. The breach was discovered on June 6, 2022, and electronic notifications were sent to affected consumers on June 19, 2023. No identity theft protection services were offered.
Maine clockDiscovered Jun 6, 2022 → Filed with AG Jun 15, 2023374d ✗ ME AG >90d12 months discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9,328 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cb880e17-15fa-4892-bb0b-c0e164fc21e9.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 15, 2023
- Raw hash
- 43afbc42881007378dc0277463627141bdd62936322c2bc4c2aa056085aea1cb
Reporting entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Victim entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Incident
- Discovered
- Jun 6, 2022
- Materiality determined
- —
- Notification sent
- Jun 19, 2023
- Affected individuals
- 9,328
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 12 months(374 days from discovery to filing)
- Compliance flags
- ME AG >90d · 374dME resident >180d · 378d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 6, 2022→ Filed with AG: Jun 15, 2023374d 90 days ME AG >90d Maine Discovered: Jun 6, 2022→ Notified: Jun 19, 2023378d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.