PhysicalRetail & ConsumerRetailTheftEmployee Data InvolvedIdentity (basic)Financial accountLowContained

Whole Foods Market Services, Inc.

bd_18d02658aac3e245 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 3, 2018

Filed

Nov 1, 2018

To disclose

13 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Whole Foods Market Services, Inc. →5 incidents on file

Whole Foods Market Group, Inc. notified the NH Attorney General that a company-issued laptop containing the name and bank account information of one New Hampshire resident was stolen from an employee's vehicle on August 3, 2018. The company engaged a forensic firm and determined the data was present. Remediation includes deploying encryption on laptops and reinforcing data handling practices.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 90 days

Aug 3, 2018

Begins

Aug 3, 2018

Discovered

Nov 1, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_88469f28ece48d192018-10-31 · +1dVerified

Name: Whole Foods Market Services, Inc.
norm: whole foods market

Name: Whole Foods Market Services, Inc.
norm: whole foods market
Industry: Retail & Consumerllm

Discovered: Aug 3, 2018
Breach occurred: Aug 3, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 31, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified the Office of the Attorney General of New Hampshire

During the incident: Began an investigation
Engaging a third-party forensic investigation firm to identify what information was stored on the laptop
Changes made: Evaluating its existing practices regarding protecting sensitive personal information
Plans to deploy encryption on company-issued laptops
Reinforcing with its employees the appropriate data handling practices for sensitive personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 31 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/whole-foods-20181101.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 1, 2018
Raw hash: 83113c61f1e17d53922e89c5a259fbcb7476a9e0d37b8228116f52f44bd32e84

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWhole Foods Market Services, Inc.

Victim entityWhole Foods Market Services, Inc.

Incidentdiscovered Aug 3, 2018

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov