MalwareRetail & ConsumerRetailRansomwareData EncryptedTargetedPCIFinancial accountLowContained

Russell Stover Chocolates, LLC

bd_27344e2717462c00 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 30, 2019

Filed

Aug 29, 2019

To disclose

—

Affected

Not disclosed

Confidence

65%

Full breach record for Russell Stover Chocolates, LLC →

Russell Stover Chocolates, LLC notified consumers of a payment card security incident affecting retail stores. Malware on POS systems may have exposed card numbers, expiration dates, and names between Feb 9 and Aug 7, 2019. The company engaged forensic experts, contained the malware, and notified law enforcement. No evidence of misuse was found at the time of notice.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 202 days

discovery → filing · ≤1 day / 0 days

Feb 9, 2019

Begins

Aug 30, 2019

Discovered

Aug 29, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Russell Stover Chocolates, LLC
norm: russell stover chocolates

Name: Russell Stover Chocolates, LLC
norm: russell stover chocolates
Industry: Retail & Consumerllm

Discovered: Aug 30, 2019
Breach occurred: Feb 9, 2019 – Aug 7, 2019
Undetected for: 202 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2019
Affected individuals: Not disclosed
Data types: PCIFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: notified the appropriate law enforcement and regulatory authorities
Initial access: external_remote_services

During the incident: Initiated an investigation
Engaged leading, independent cybersecurity experts
Took measures to eradicate and contain the malware
Removing the malware from our systems
Notified the appropriate law enforcement and regulatory authorities
Working closely with the payment card companies
Changes made: Working to further strengthen our security measures
Enhanced employee training
Improved technical measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2019/RussellStover.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2019
Raw hash: ccc2429b27f9f5d511c8d2f7210c6090217fe5fa74ae9df5568573fa5f5c7525

Reporting entityRussell Stover Chocolates, LLC

Victim entityRussell Stover Chocolates, LLC

Incidentdiscovered Aug 30, 2019

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov