MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Vermont Nut Free Chocolates

bd_303dc495dd82e656 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 29, 2022

Filed

Sep 1, 2022

To disclose

5 weeks

Affected

521state residents only

Linked

7 filings

Confidence

69%

Full breach record for Vermont Nut Free Chocolates →

Vermont Nut Free Chocolates notified the Washington AG of a third-party vendor (Freestyle Solutions) malware incident affecting 521 Washington residents. Unauthorized access occurred between Sept 2020 and Feb 2022, exposing payment card info, names, and billing addresses. Notification to residents began Aug 29, 2022.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 679 days

discovery → filing · 5 weeks / 34 days

Sep 18, 2020

Begins

Jul 29, 2022

Discovered

Sep 1, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_aa3461363090db2a2022-09-01Verified by operator
Maine State AGbd_ee6b2d26bfc660492022-09-01Verified
Massachusetts State AGbd_f2929f3477f533482022-09-01Verified
Montana State AGbd_142a019cb307a98d2022-08-31 · +1dVerified by operator

Show 2 more filings ↓up to 5d gap

Indiana State AGbd_02f646a90c22cd462022-08-29 · +3dVerified by operator
New Hampshire State AGbd_c48066161c852e3b2022-09-06 · +5dVerified by operator

Name: Vermont Nut Free Chocolates
norm: vermont nut free chocolates
Domain: vermontnutfree.com

Name: Vermont Nut Free Chocolates
norm: vermont nut free chocolates
Domain: vermontnutfree.com
Industry: Retail & Consumerllm

Discovered: Jul 29, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 679 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2022
Affected individuals: 521state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Submitted notification to Washington Attorney General Consumer Protection Division
Third party: via Freestyle Solutions
Initial access: supply_chain

During the incident: Freestyle Solutions launched an investigation into the incident to remediate and contain the malware
Vermont Nut Free Chocolates conducted a thorough review to identify the individuals impacted
Vermont Nut Free Chocolates took steps to ensure Freestyle Solutions had contained the threat and disabled all unauthorized access
Freestyle Solutions notified law enforcement authorities
Freestyle Solutions retained data security experts to conduct an investigation
Vermont Nut Free Chocolates is providing the affected residents with written notification
Vermont Nut Free Chocolates is advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Changes made: Freestyle Solutions removed the malware from its systems
Vermont Nut Free Chocolates is working with Freestyle Solutions to assure that it takes steps to prevent events like this in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGAug 29 · first

Montana State AG+2d

California State AG+3d

Maine State AG+3d

Massachusetts State AG+3d

Washington State AG+3d · this page

New Hampshire State AG+8d

Pattern: first filing Aug 29 (IN), last Sep 6 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14940.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2022
Raw hash: 60b02bf029b0a7e495d3029d72584903e47225ec12738cf375ea27061a457889

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityVermont Nut Free Chocolates

Victim entityVermont Nut Free Chocolates

Incidentdiscovered Jul 29, 2022

Stated responseFreestyle Solutions launched an investigation into the incident to remediate and contain the malware

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com