HackingSkimmerCapture Stored DataSupply Chain (3P Vendor)Delayed DiscoveryCustomer Data InvolvedIDENTITY_BASICPCIFINANCIAL_ACCOUNTMediumContained
Pennsylvania General Store
bd_0a85d081d999d2b5 · schema v1 · pii pii-v1
Full breach record for Pennsylvania General Store →Pennsylvania General Store, a retail entity, reported a data breach affecting 19,454 individuals. The breach was caused by a skimming attack on its third-party e-commerce vendor, CommerceV3, which compromised customer names and payment card information. The incident occurred on November 24, 2021, but was not discovered until June 6, 2023. Affected individuals were notified on September 15, 2023.
Maine clockDiscovered Jun 6, 2023 → Filed with AG Oct 27, 2023143d ✗ ME AG >90d20 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_4c4e49ad2408dba3California State AGfiled 2023-10-27Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e6b8ea2b-3146-4249-ad9c-b8b2eb758fc8.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 27, 2023
- Raw hash
- 92fe7650307c553f659ce2095ceee9af9faab1ecd5f5f1a86128d1c4a6f44233
Reporting entity
- Name
- Pennsylvania General Storenorm: pennsylvania general store
Victim entity
- Name
- Pennsylvania General Storenorm: pennsylvania general store
Incident
- Discovered
- Jun 6, 2023
- Materiality determined
- —
- Notification sent
- Sep 15, 2023
- Affected individuals
- 19,454
- Data types
- IDENTITY_BASICPCIFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1056 Input Capture
- Threat actor
- ExternalFinancial
Compliance
- Time to disclose
- 20 weeks(143 days from discovery to filing)
- Compliance flags
- ME AG >90d · 143dME resident >60d · 101d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 6, 2023→ Filed with AG: Oct 27, 2023143d 90 days ME AG >90d Maine Discovered: Jun 6, 2023→ Notified: Sep 15, 2023101d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.