HackingRetail & ConsumerRetailCustomer Data InvolvedTargetedIdentity (basic)Financial accountMediumContained

Bob's Discount Furniture, LLC

bd_0a8a5591979b5020 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 25, 2024

Filed

Dec 3, 2024

To disclose

10 weeks

Affected · nationwide

5,22272 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Bob's Discount Furniture, LLC →2 incidents on file

Bob's Discount Furniture, LLC reported an external system breach (hacking) on September 25, 2024, affecting 5,222 individuals nationwide, including 72 Maine residents. The incident exposed names and MyBob's Card account numbers. Bob's engaged a cybersecurity firm, notified law enforcement and financial institutions, and mailed notifications on December 3, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 25, 2024 → Filed with AG Dec 3, 202469d ⏱ ME AG >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 69 days

Sep 25, 2024

Begins

Sep 25, 2024

Discovered

Dec 3, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_284aa6e5aa97e4d02024-12-03Verified
California State AGbd_41984e56b842b69d2024-12-03Verified
New Hampshire State AGbd_507cb7ae3b222a472024-12-03Verified
Massachusetts State AGbd_c6aba9a89d14ed9b2024-12-03Verified

Name: Bob's Discount Furniture, LLC
norm: bob s discount furniture
Domain: bobsdiscountfurniture.com

Name: Bob's Discount Furniture, LLC
norm: bob s discount furniture
Domain: bobsdiscountfurniture.com
Industry: Retail & Consumerllm

Discovered: Sep 25, 2024
Breach occurred: Sep 25, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 3, 2024
Affected individuals: 5,222state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Implemented response protocols
Took measures to contain the activity
Launched an investigation
Engaged a cybersecurity firm
Notified law enforcement
Notified the financial institutions
Changes made: Put in place protocols to prevent unauthorized purchases
Taken and is taking additional steps to further enhance its existing network security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: ME AG >30d · 69d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 25, 2024
→ Filed with AG: Dec 3, 2024
69d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 25, 2024 → Filed with AG: Dec 3, 2024	69d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 3 · first

California State AGDec 3 · first

New Hampshire State AGDec 3 · first

Massachusetts State AGDec 3 · first

Maine State AGDec 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/485c3670-0433-44d0-baea-4047115f1b1b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 3, 2024
Raw hash: cfd1de05f79901c531b2e55eaf1e8ad216af74482ecf19ee874e42872a6ebe17

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBob's Discount Furniture, LLC

Victim entityBob's Discount Furniture, LLC

Incidentdiscovered Sep 25, 2024

Stated responseImplemented response protocols

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov