HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLocationLowContained

J&D Brush Co.

bd_44c894ac53dba0fc · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 26, 2023

To disclose

—

Affected

54state residents only

Linked

4 filings

Confidence

66%

Full breach record for J&D Brush Co. →

J&D Brush Co. LLC dba Bio Ionic notified the Idaho Attorney General that unauthorized code was placed on its website between March 7 and March 27, 2023, potentially capturing personal and payment card information of consumers. The incident affected 54 Idaho residents. The company engaged forensic investigators, notified law enforcement, and is reviewing security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 7, 2023

Begins

Jul 26, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_65ab0d9ad599b2222023-07-19 · +7dVerified
Maine State AGbd_a8bdba0e9d8596372023-07-17 · +9dCandidate
Indiana State AGbd_ef9f1b0bef0c24062023-07-17 · +9dVerified

Name: J&D Brush Co.
norm: j d brush

Name: J&D Brush Co.
norm: j d brush
Also named: J&D Brush Co. LLCdba oflegal entity
Bio Ionicdba oftrade name
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Mar 7, 2023 – Mar 27, 2023
Materiality determined: —
Notification sent: Jul 17, 2023
Affected individuals: 54state-resident count only
Data types: Identity (basic)Financial accountLocation
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Idaho Attorney General
Initial access: exploit_public_facing

During the incident: Initiated an internal investigation
Notified law enforcement
Engaged a leading forensic cybersecurity firm to assist in its investigation and to confirm the security of its website and computer systems
Working with the credit card brands to address the issue
Notifying the potentially involved individuals
Providing information on how they can protect themselves against fraudulent activity and identity theft
Changes made: Reviewing its information security policies
Evaluating additional controls it can implement to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJul 17 · first

Indiana State AGJul 17 · first

Massachusetts State AG+2d

Idaho State AG+9d · this page

Pattern: first filing Jul 17 (ME), last Jul 26 (ID) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/07/7-26-2023-JD-Brush-Co.-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2023
Raw hash: 1e9cfba7bbf5da0f901ab076145bf92d6a21a9bf916602fa75f6f5762ee4357d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJ&D Brush Co.

Victim entityJ&D Brush Co.

IncidentUnauthorized Access

Stated responseInitiated an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov