HackingIdentity (basic)Financial accountLowContained

Hawaii Coffee Company LLC

bd_0aff9f941d00defb · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2023

Filed

Sep 26, 2023

To disclose

15 weeks

Affected

15state residents only

Linked

5 filings

Confidence

66%

Full breach record for Hawaii Coffee Company LLC →

Hawaii Coffee Company notified the New Hampshire Attorney General of a breach affecting 15 state residents. Unauthorized access to its BigCommerce e-commerce platform occurred between February 14, 2023, and March 22, 2023. The incident compromised names and payment card information for a subset of transactions. The company discovered the breach on June 14, 2023, and mailed notifications to affected residents on September 25, 2023. Remediation included enhancing email security.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 120 days

discovery → filing · 15 weeks / 104 days

Feb 14, 2023

Begins

Jun 14, 2023

Discovered

Sep 26, 2023

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_187a14508c9393af2023-09-26Verified
Maine State AGbd_747493305017ba2d2023-09-26Candidate
Indiana State AGbd_84527d59a61992ba2023-09-25 · +1dVerified
Montana State AGbd_8b040a24556f5d952023-09-25 · +1dCandidate

Name: Hawaii Coffee Company LLC
norm: hawaii coffee

Name: Hawaii Coffee Company LLC
norm: hawaii coffee

Discovered: Jun 14, 2023
Breach occurred: Feb 14, 2023 – Mar 22, 2023
Undetected for: 120 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2023
Affected individuals: 15state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took steps to ensure its network was secure
Conducted a thorough review of all transactions that took place during the incident period
Provided written notice to the New Hampshire residents by mailing a letter via United States Postal Service first-class mail
Changes made: Implemented additional steps to further enhance the security of its email environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 25 · first

Montana State AGSep 25 · first

Massachusetts State AG+1d

Maine State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hawaii-coffee-company-20230926.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2023
Raw hash: f76bec386a33675578732d2939a8fa2dcdb43ae8239a16053c83507001191895

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHawaii Coffee Company LLC

Victim entityHawaii Coffee Company LLC

Incidentdiscovered Jun 14, 2023

Stated responseTook steps to ensure its network was secure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov