HackingRetail & ConsumerRetailVulnerability ExploitStolen CredentialsTargetedData ExfiltratedIdentity (basic)CredentialsFinancial accountLowContained

Bulk Reef Supply

bd_128a3b34181647a2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 21, 2015

Filed

Mar 4, 2015

To disclose

6 weeks

Affected

211state residents only

Linked

5 filings

Confidence

64%

Full breach record for Bulk Reef Supply →

Bulk Reef Supply, Inc. reported a cybersecurity incident where an external hacker compromised customer data accessed between July 30, 2014, and January 30, 2015. The breach, discovered on January 21, 2015, exposed names, addresses, contact info, passwords, and credit card data. BRS retained forensic experts, contained the intrusion, notified law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 175 days

discovery → filing · 6 weeks / 42 days

Jul 30, 2014

Begins

Jan 21, 2015

Discovered

Mar 4, 2015

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_0378b0e77d1f93bc2015-02-27 · +5dCandidate
California State AGbd_83c1f7e39a6d6af82015-02-27 · +5dCandidate
New Hampshire State AGbd_1aa826d93d395fc72015-04-30 · +57dVerified
Massachusetts State AGbd_79b009f163621d2d2015-05-04 · +61dVerified

Name: Bulk Reef Supply
norm: bulk reef supply
Domain: bulkreefsupply.com

Name: Bulk Reef Supply
norm: bulk reef supply
Domain: bulkreefsupply.com
Industry: Retail & Consumerllm

Discovered: Jan 21, 2015
Breach occurred: Jul 30, 2014 – Jan 30, 2015
Undetected for: 175 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2015
Affected individuals: 211state-resident count only
Data types: Identity (basic)CredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Retained a forensic expert company
Isolated and stopped the intrusion
Performed forensic analysis
Secured the site and information in question
Added additional protections to the locations of the personal information
Put monitoring measures in place
Notified law enforcement
Changes made: Added additional protections to the locations of the personal information
Put monitoring measures in place to insure this attack has been stopped and will not occur in the future
Offering a complimentary one-year membership of Experian’s ProtectMyID Alert
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

New Hampshire State AGFeb 27 · first

California State AGFeb 27 · first

South Carolina State AG+5d · this page

New Hampshire State AG+62d

Massachusetts State AG+66d

Pattern: first filing Feb 27 (NH), last May 4 (MA) — a 66-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2015/BulkReefSupply.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2015
Raw hash: b5d4b15e6cd0e668bea58c6e2c00f8c3db374891d6d85a9a31654ccd4f772227

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBulk Reef Supply

Victim entityBulk Reef Supply

Incidentdiscovered Jan 21, 2015

Stated responseRetained a forensic expert company

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov