MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Best Buy Co., Inc.

bd_3d9c5856ad205a4c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2018

Filed

Apr 13, 2018

To disclose

16 days

Affected

8,390state residents only

Linked

6 filings

Confidence

69%

Full breach record for Best Buy Co., Inc. →5 incidents on file

Best Buy Co, Inc. reported a data breach affecting Washington residents due to a cyber intrusion of third-party vendor [24]7.ai. Malicious code inserted between Sept 26 and Oct 12, 2017, allowed unauthorized access to customer payment card info and PII. Best Buy discovered the issue in March 2018, engaged forensic experts, and provided 1 year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 183 days

discovery → filing · 16 days

Sep 26, 2017

Begins

Mar 28, 2018

Discovered

Apr 13, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Part of [24]7.ai supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_8fa5e4e8d23657b22018-04-13Verified
California State AGbd_abf1ad4c92fe52282018-04-13Verified
New Hampshire State AGbd_aed67aaeddf0751b2018-04-13Verified
Montana State AGbd_935b6af16c9aadf62018-04-12 · +1dCandidate

Show 1 more filing ↓up to 12d gap

Oregon State AGbd_3127e7742cdefbe02018-04-25 · +12dVerified

Name: Best Buy Co., Inc.
norm: best buy

Name: Best Buy Co., Inc.
norm: best buy
Industry: Retail & Consumerllm

Discovered: Mar 28, 2018
Breach occurred: Sep 26, 2017 – Oct 12, 2017
Undetected for: 183 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 12, 2018
Affected individuals: 8,390state-resident count only
Data types: Identity (basic)Financial account
Data elements: Financial account numberName
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Coordinating with law enforcement authorities in their investigation
Third party: via [24]7.ai
Initial access: supply_chain

During the incident: Engaged leading data security experts to assist with the investigation
Confirmed that the malicious code had been removed from its software
Confirmed that the unauthorized access had been stopped
Made changes to how the [24]7.ai software operates on its website
Publicly announced the incident
Coordinating with law enforcement authorities in their investigation
Arranged to provide affected customers with identity theft services, including credit monitoring, at no cost for one year
Changes made: Changes made to how the [24]7.ai software operates on its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGApr 12 · first

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+1d

Washington State AG+1d · this page

Oregon State AG+13d

Pattern: first filing Apr 12 (MT), last Apr 25 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9562.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2018
Raw hash: c7c203b354d023c84e0896574a318f8706734e31e5c1ab2647286c391d37e564

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBest Buy Co., Inc.

Victim entityBest Buy Co., Inc.

Incidentdiscovered Mar 28, 2018

Stated responseEngaged leading data security experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com