HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Health (basic)Financial accountLowContained

JAND Inc.

bd_117cd5271d2bb7d8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 26, 2018

Filed

Dec 24, 2018

To disclose

28 days

Affected

177state residents only

Linked

4 filings

Confidence

63%

Full breach record for JAND Inc. →

Warby Parker notified NH AG of credential stuffing incident affecting 177 NH residents. Unauthorized actors used stolen credentials from other breaches to attempt login. No proof of actual data theft, but potential access to names, emails, prescriptions, and last 4 digits of payment cards. Notifications sent Dec 20, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 62 days

discovery → filing · 28 days

Sep 25, 2018

Begins

Nov 26, 2018

Discovered

Dec 24, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_512491b6332a1e102018-12-26 · +2dVerified
California State AGbd_b170633faba40bb92018-12-21 · +3dCandidate
Washington State AGbd_51d95883578ecc222018-12-20 · +4dVerified

Name: JAND Inc.
norm: jand
Domain: warbyparker.com

Name: JAND Inc.
norm: jand
Domain: warbyparker.com
Also named: JAND Inc.dba oflegal entity
Warby Parkerdba oftrade name
Industry: Retail & Consumerllm

Discovered: Nov 26, 2018
Breach occurred: Sep 25, 2018 – Nov 26, 2018
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2018
Affected individuals: 177state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported the matter to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Began to investigate with the assistance of outside experts
Required that potentially affected users reset their passwords upon log-in
Reported the matter to the Federal Bureau of Investigation
Changes made: Engaged third-party cybersecurity experts
Continue to monitor site traffic closely
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGDec 20 · first

California State AG+1d

New Hampshire State AG+4d · this page

Massachusetts State AG+6d

Pattern: first filing Dec 20 (WA), last Dec 26 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/warby-parker-20181224.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 24, 2018
Raw hash: 18ba8503cdf5d00ad32e5f0a49205d44fb9aea1913b9f78e6f2f00310f069411

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJAND Inc.

Victim entityJAND Inc.

Incidentdiscovered Nov 26, 2018

Stated responseBegan to investigate with the assistance of outside experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov