HackingRetail & ConsumerHospitalityRetailStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDMediumContained

The Coffee Bean & Tea Leaf

bd_20453311b601f3f7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2024

Filed

Dec 19, 2024

To disclose

28 weeks

Affected

17state residents only

Linked

4 filings

Confidence

65%

Full breach record for The Coffee Bean & Tea Leaf →

The Coffee Bean & Tea Leaf experienced unauthorized access to systems and email accounts between April and August 2024. The breach affected 17 New Hampshire residents, potentially exposing PII. The company notified law enforcement, offered credit monitoring, and implemented employee training.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d28 weeks discovery → filing

Incident timeline

undetected · 62 days

discovery → filing · 28 weeks / 196 days

Apr 5, 2024

Begins

Jun 6, 2024

Discovered

Nov 13, 2024

Scope determined

Dec 19, 2024

Filed

vs. sector median

+20 wks slower

This filing is one of 4 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 196 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_5042001118525dc12024-06-06 · +196dVerified by operator

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_7aa3405e4ee0c8472024-12-19Verified by operator
California State AGbd_8ec97dcd2c6e38e32024-12-19Candidate

Name: International Coffee & Tea
norm: international coffee tea
Domain: jollibeefoods.com

Name: The Coffee Bean & Tea Leaf
norm: the coffee bean tea leaf
Domain: coffeebean.com
Industry: Retail & ConsumerllmHospitalityllm

Discovered: Jun 6, 2024
Breach occurred: Apr 5, 2024 – Aug 29, 2024
Undetected for: 62 daysoccurrence → discovery
Materiality determined: Nov 13, 2024
Notification sent: Dec 19, 2024
Affected individuals: 17state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProvided written notice of this incident to relevant state regulators
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists and internal teams
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided individuals with information on how to place a fraud alert and security freeze on one’s credit file
Provided written notice of this incident to relevant state regulators
Provided written notice to the three major credit reporting agencies
Changes made: Implementing trainings to its employees
Assessing and further strengthening the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(196 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGDec 19 · first

California State AGDec 19 · first

New Hampshire State AGDec 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/international-coffee-tea-20241219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2024
Raw hash: 5e51a7274e632f25874296e7f28993d8bb21ca03a23d965eb11142893c5db78c

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityInternational Coffee & Tea

Victim entityThe Coffee Bean & Tea Leaf

Incidentdiscovered Jun 6, 2024

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists and internal teams

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov