MalwareRetail & ConsumerRetailInfostealerCustomer Data InvolvedIdentity (basic)Financial accountLowContained

VALRHONA, INC.

bd_23db11c19aa7a09b · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 4, 2023

Filed

Nov 30, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for VALRHONA, INC. →

Valrhona Inc. discovered malicious software on its website on October 4, 2023. The malware collected customer credit card information, names, addresses, dates of birth, and emails. The California Attorney General lists the breach date as September 2, 2021. Valrhona disabled the website, engaged cybersecurity experts, and offered 12 months of Experian IdentityWorks to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 762 days

discovery → filing · 8 weeks / 57 days

Sep 2, 2021

Begins

Oct 4, 2023

Discovered

Nov 30, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_3548dcb349a591e02023-11-30Candidate
Massachusetts State AGbd_e47cc1c93dfd13682023-11-30Verified
Vermont State AGbd_31d276f3e634f03e2023-12-01 · +1dVerified
Montana State AGbd_cc72e9f5f2ad358d2023-12-01 · +1dVerified

Name: VALRHONA, INC.
norm: valrhona

Name: VALRHONA, INC.
norm: valrhona
Industry: Retail & Consumerllm

Discovered: Oct 4, 2023
Breach occurred: Sep 2, 2021
Undetected for: 762 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unknown
MITRE ATT&CK: T1056 Input Capture
Threat actor: External

During the incident: Disabled the website
Engaged leading cybersecurity experts
Launched an investigation
Offering complimentary access to Experian IdentityWorks for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGNov 30 · first

Massachusetts State AGNov 30 · first

California State AGNov 30 · first · this page

Vermont State AG+1d

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-577291
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2023
Raw hash: 593e100be410f7513e51c395db1deebd3f1ec11fea28da8f1974edd625539f62

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityVALRHONA, INC.

Victim entityVALRHONA, INC.

Incidentdiscovered Oct 4, 2023

Stated responseDisabled the website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov