HackingRetail & ConsumerRetailEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)EmploymentMediumContained

Spencer Gifts LLC

bd_134105033d4688ab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 25, 2021

Filed

Jan 24, 2022

To disclose

9 weeks

Affected

Not disclosed

Linked

9 records

Confidence

66%

Full breach record for Spencer Gifts LLC →

Spencer Gifts LLC detected a security incident on November 25, 2021, impacting its corporate network. An unauthorized actor accessed the network between November 24 and November 26, 2021, potentially accessing employee payroll and health plan enrollment files containing names, Social Security numbers, health plan selections, and direct deposit account numbers. The company contained the incident, notified law enforcement, and offered one year of Experian IdentityWorks to affected employees.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d9 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 60 days

Nov 24, 2021

Begins

Nov 25, 2021

Discovered

Jan 24, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 9 records about the same incident.View merged incident

A leak claim by conti about this victim was first seen 50 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecontibd_9a43f4ffe8f6e3282021-12-05 · +50dVerified by operator

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_3299e43485b49f6c2022-01-24Verified
Indiana State AGbd_38950aecb2b7c1232022-01-24Verified
Montana State AGbd_9e247c7d6362456b2022-01-24Verified
New Hampshire State AGbd_fc5a7f6f8ca435c32022-01-24Verified

Show 3 more filings ↓up to 23d gap

Illinois State AGbd_200fa12843aff8fe2022-01-01 · +23dCandidate
Illinois State AGbd_d25863908abf22e62022-01-01 · +23dVerified
Illinois State AGbd_e3751d5a6571c4562022-01-01 · +23dVerified

Name: Spencer Gifts LLC
norm: spencer gifts

Name: Spencer Gifts LLC
norm: spencer gifts
Industry: Retail & Consumerllm

Discovered: Nov 25, 2021
Breach occurred: Nov 24, 2021 – Nov 26, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took measures to contain the incident
Notified law enforcement
Began an investigation
Arranged for complimentary one-year membership in Experian IdentityWorks
Changes made: Reviewing and enhancing existing security protocols and practices
Implementation of additional electronic security features
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+23d

Indiana State AG+23d

Montana State AG+23d

New Hampshire State AG+23d

California State AG+23d · this page

Pattern: first filing Jan 1 (IL), last Jan 24 (CA) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-550257
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2022
Raw hash: 3213de0e5323b9fb601e6309f21e6c78b81a4589d4fff8e80aa509ef8348ecdb

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entitySpencer Gifts LLC

Victim entitySpencer Gifts LLC

Incidentdiscovered Nov 25, 2021

Stated responseTook measures to contain the incident

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov