HackingRetail & ConsumerRetailStolen CredentialsPhishingCustomer Data InvolvedTargetedIdentity (basic)Financial accountCredentialsLowContained

Sugarfina USA, LLC

bd_2dd44e96e0178398 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 15, 2021

Filed

Jun 1, 2021

To disclose

20 weeks

Affected

150state residents only

Linked

9 filings

Confidence

66%

Full breach record for Sugarfina USA, LLC →

Sugarfina USA, LLC notified the NH AG of a cyber-attack affecting ~150 NH residents. Unauthorized actors may have accessed payment card info (name, address, CC#, exp, CVV, username/password) from orders placed Nov 2019–Sep 2020. Attack discovered Jan 2021; notification sent May 2021. Malicious code on website allowed access. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 441 days

discovery → filing · 20 weeks / 137 days

Nov 1, 2019

Begins

Jan 15, 2021

Discovered

Jun 1, 2021

Filed

vs. sector median

+12 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_5ca080b9a6988def2021-05-25 · +7dVerified
Massachusetts State AGbd_8fd4aa394c9b33e92021-05-25 · +7dVerified
California State AGbd_9ef0158eb8fcad352021-05-25 · +7dVerified
Oregon State AGbd_af6dc0ec43bde3f12021-05-25 · +7dVerified

Show 4 more filings ↓up to 151d gap

Indiana State AGbd_b2b0346c19ea77922021-05-25 · +7dVerified
Montana State AGbd_cbbc835a8a32a5592021-05-25 · +7dVerified
Washington State AGbd_ce2b887a3ceb24d22021-05-25 · +7dVerified
Illinois State AGbd_ea98cd3f8d09cd7d2021-01-01 · +151dCandidate

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com
Industry: Retail & Consumerllm

Discovered: Jan 15, 2021
Breach occurred: Nov 1, 2019 – Sep 3, 2020
Undetected for: 441 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2021
Affected individuals: 150state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Preliminary notice of this event was submitted to your office on April 26, 2021
Initial access: exploit_public_facing

During the incident: Launched an investigation to determine the nature and scope of this incident
Performed a comprehensive review of information stored on the impacted systems
Conducted a manual review of its records to determine the identities and contact information for potentially impacted individuals
Took steps to address the issue and to secure its website
Notifying relevant regulatory authorities of this event
Changes made: Reviewing its existing policies and procedures
Implementing additional safeguards to further secure the payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+144d

Massachusetts State AG+144d

California State AG+144d

Oregon State AG+144d

Indiana State AG+144d

Montana State AG+144d

Washington State AG+144d

New Hampshire State AG+151d · this page

Pattern: first filing Jan 1 (IL), last Jun 1 (NH) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sugarfina-usa-20210601.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2021
Raw hash: 9dce4a37edf12c61a447312c44ed5d411e7b5474a5c1a7b00f0504362dc0f644

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySugarfina USA, LLC

Victim entitySugarfina USA, LLC

Incidentdiscovered Jan 15, 2021

Stated responseLaunched an investigation to determine the nature and scope of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov