HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Farmer Brothers Company

bd_2346ff290be14cdb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2025

Filed

Sep 9, 2025

To disclose

26 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

65%

Full breach record for Farmer Brothers Company →2 incidents on file

Farmer Brothers Company notified consumers of a data breach where an unknown actor accessed archived files between March 6 and 14, 2025. The incident involved personal information including names and government IDs. The company reported the incident to federal law enforcement and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday26 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 26 weeks / 179 days

Mar 6, 2025

Begins

Mar 14, 2025

Discovered

Sep 9, 2025

Filed

vs. sector median

+18 wks slower

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_4bcd2385a0817f7d2025-09-09Candidate
California State AGbd_557b222edc9b4bbd2025-09-09Verified
Nebraska State AGbd_7a93c640411fc20b2025-09-09Verified
Maine State AGbd_a19ba8de6f2b3f9b2025-09-09Verified by operator

Show 6 more filings ↓up to 1d gap

Montana State AGbd_bf5d5f7c554e3c442025-09-09Verified by operator
Massachusetts State AGbd_cf064c1fa318e4872025-09-09Verified
Indiana State AGbd_d19f1c0203deb1242025-09-09Verified
New Hampshire State AGbd_ff0874b846405f0e2025-09-09Verified
Washington State AGbd_611ab6b8e533b4542025-09-10 · +1dVerified by operator
Texas State AGbd_6975b4edc70a99852025-09-10 · +1dVerified

Showing first 10 of 11 linked disclosures.

Name: Farmer Brothers Company
norm: farmer brothers
Domain: farmerbros.com

Name: Farmer Brothers Company
norm: farmer brothers
Domain: farmerbros.com
Industry: Retail & Consumerllm

Discovered: Mar 14, 2025
Breach occurred: Mar 6, 2025 – Mar 14, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: Sep 9, 2025
Notification sent: Sep 9, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Reported this event to federal law enforcement
Initial access: valid_credentials

During the incident: Reported this event to federal law enforcement and supported their investigation
Offering you access to twelve (12) months of complimentary credit monitoring and identity restoration services through TransUnion
Changes made: Reviewed our existing policies and procedures and added additional administrative safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Oregon State AGSep 9 · first

California State AGSep 9 · first

Nebraska State AGSep 9 · first

Maine State AGSep 9 · first

Montana State AGSep 9 · first

Massachusetts State AGSep 9 · first

Indiana State AGSep 9 · first

New Hampshire State AGSep 9 · first

Vermont State AGSep 9 · first · this page

Washington State AG+1d

Texas State AG+1d

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-09-09-farmer-brothers-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 9, 2025
Raw hash: a61a2aa380074a99a1441e23513064098b4dadcc6aa61607b7807fa01ee555ee

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityFarmer Brothers Company

Victim entityFarmer Brothers Company

Incidentdiscovered Mar 14, 2025

Stated responseReported this event to federal law enforcement and supported their investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov