HackingRetail & ConsumerRetailSkimmerBackdoor / C2Data ExfiltratedCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)PCILowContained

Primary Jane, LLC

bd_36041fb977728d6f · schema v1 · pii pii-v2

Severity

Low

Discovered

Jul 21, 2026

Filed

Aug 1, 2026

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for Primary Jane, LLC →

Primary Jane, LLC experienced a website compromise where malicious code was installed to harvest credit card data from July 13-21, 2026. The incident was detected on July 21, 2026. Affected data includes credit/debit card numbers, expiration dates, CVV codes, names, and zip codes. The company secured the website, engaged forensic professionals, notified law enforcement, and implemented MFA and password resets.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

Jul 13, 2026

Begins

Jul 21, 2026

Discovered

Aug 1, 2026

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_34585579e3dd7ba12026-08-20 · +19dVerified

Name: Primary Jane, LLC
norm: primary jane

Name: Primary Jane, LLC
norm: primary jane
Industry: Retail & Consumerllm

Discovered: Jul 21, 2026
Breach occurred: Jul 13, 2026 – Jul 21, 2026
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2026
Affected individuals: 1state-resident count only
Data types: Financial accountFinancial credentialsIdentity (basic)PCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified state regulators
Initial access: exploit_public_facing

During the incident: Notified and working with outside IT support to secure the Company’s website
Engaged professionals experienced in handling these types of incidents to assist with response and assess scope
Notified and cooperating with law enforcement and state regulators
Required a password reset for account holders
Offering multi-factor authentication related to account logins
Changes made: Working with cybersecurity professionals to evaluate and modify practices and internal controls
Implemented additional security measures including password resets and multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 1 · first · this page

Indiana State AG+19d

Pattern: first filing Aug 1 (MA), last Aug 20 (IN) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1459-primary-jane-llc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2026
Raw hash: 6cadad5d19f80f103ae7635643744c1c9a0945149526ace424f16ef20e56238c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPrimary Jane, LLC

Victim entityPrimary Jane, LLC

Incidentdiscovered Jul 21, 2026

Stated responseNotified and working with outside IT support to secure the Company’s website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov