HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)LowContained

Mission Linen Supply Company

bd_28433580056b9541 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 29, 2012

Filed

Jul 24, 2012

To disclose

25 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Mission Linen Supply Company →

Mission Linen Supply Company notified customers of a security incident involving a third-party vendor hosting its web stores. On June 29, 2012, the company learned of unauthorized credit card charges. The vendor stored personally identifiable information, including credit/debit card numbers, expiration dates, and names. The company engaged law enforcement, notified banks, and arranged for one year of free credit monitoring via Equifax. The vendor ceased storing credit card data.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 29, 2012 → Notified Jul 20, 201221d ✓ CA 60-day OK25 days discovery → filing

Incident timeline

discovery → filing · 25 days

Jun 29, 2012

Begins

Jun 29, 2012

Discovered

Jul 24, 2012

Filed

vs. sector median

6 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_68a732540c14b0eb2012-07-24Verified
Massachusetts State AGbd_596bf66e5aeb66362012-07-26 · +2dVerified

Name: Mission Linen Supply Company
norm: mission linen supply
Domain: missionlinen.com

Name: Mission Linen Supply Company
norm: mission linen supply
Domain: missionlinen.com
Industry: Retail & Consumerllm

Discovered: Jun 29, 2012
Breach occurred: Jun 29, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2012
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified local law enforcement, including the U.S. Secret Service
Third party: via Third party vendor
Initial access: supply_chain

During the incident: Contacted credit card processor
Contacted third party vendor
Directed vendor to protect all personal information that might have been compromised
Began sending urgent emails to customers alerting them of the possibility of compromise
Began an extensive internal investigation
Notified local law enforcement, including the U.S. Secret Service
Notified merchant bank of the suspected issue
Changes made: Third party vendor will no longer be collecting or storing any credit card information at all
Credit card information will only be collected by a processor whose sole job is the secure collection and processing of credit card information
Arranged with Equifax to provide credit monitoring for a year at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: CA 60-day OK · 21d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 29, 2012
→ Notified: Jul 20, 2012
21d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 29, 2012 → Notified: Jul 20, 2012	21d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJul 24 · first

California State AGJul 24 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-32356
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 24, 2012
Raw hash: ca55c47eb50b09206320276dd70aa63c03949cbdd2e1d40fca4bfa585c6caa41

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMission Linen Supply Company

Victim entityMission Linen Supply Company

Incidentdiscovered Jun 29, 2012

Stated responseContacted credit card processor

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov