HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedFinancial accountIdentity (basic)LowContained

BOB'S RED MILL NATURAL FOODS, INC.

bd_145b8bd7a6923e07 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 22, 2022

Filed

Apr 15, 2022

To disclose

24 days

Affected

12state residents only

Linked

15 filings

Confidence

65%

Full breach record for BOB'S RED MILL NATURAL FOODS, INC. →

Bob's Red Mill Natural Foods, Inc. notified the NH AG of a data security incident occurring Feb 23-Mar 1, 2022. Malicious software scraped payment card and personal info from its website. 12 NH residents affected. Fraudulent charges reported starting Mar 22. Incident contained; software removed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 27 days

discovery → filing · 24 days

Feb 23, 2022

Begins

Mar 22, 2022

Discovered

Apr 15, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 15 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_933ee2b9af26142e2022-04-15Verified
Maine State AGbd_b9fb048eefc08f012022-04-15Verified
Maine State AGbd_03dabe7d25bc43d02022-04-12 · +3dVerified
Massachusetts State AGbd_dcd71ea5c18373b02022-04-20 · +5dVerified

Show 6 more filings ↓up to 99d gap

Indiana State AGbd_3a1fb212b8affff72022-04-22 · +7dVerified
New Hampshire State AGbd_c2771f0f144138e42022-01-24 · +81dVerified
Maine State AGbd_e2fee1411f242afb2022-01-19 · +86dVerified
Indiana State AGbd_e862f05ab79a3f792022-01-18 · +87dVerified
New Hampshire State AGbd_33c28cc606982e302022-01-07 · +98dVerified
Maine State AGbd_380a45d9f2b5d41e2022-01-06 · +99dVerified

Showing first 10 of 14 linked disclosures.

Name: Wildwood
norm: wildwood
Domain: wildwoodhome.com

Name: BOB'S RED MILL NATURAL FOODS, INC.
norm: bob s red mill natural foods
Industry: Retail & Consumerllm

Discovered: Mar 22, 2022
Breach occurred: Feb 23, 2022 – Mar 1, 2022
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2022
Affected individuals: 12state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Began an investigation and took steps to fix the problem
Isolated and removed the malicious software
Notified its payment processor
Notified the payment-card brands it works with (American Express, Discover, Mastercard, and Visa)
Changes made: Bolster its data security and incident-response processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Maine State AGJan 6 · first

New Hampshire State AG+1d

Indiana State AG+12d

Maine State AG+13d

New Hampshire State AG+18d

Maine State AG+96d

Montana State AG+99d

Maine State AG+99d

New Hampshire State AG+99d · this page

Massachusetts State AG+104d

Indiana State AG+106d

Pattern: first filing Jan 6 (ME), last Apr 22 (IN) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bobs-red-mill-natural-foods-20220415.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2022
Raw hash: 53be5a1be7fd6bcea60bd6dc0457affd40495e953d68523554da2392afc7ca75

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityWildwood

Victim entityBOB'S RED MILL NATURAL FOODS, INC.

Incidentdiscovered Mar 22, 2022

Stated responseBegan an investigation and took steps to fix the problem

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov