HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Freedom Smokes, Inc.

bd_4e49f3dce467da5c · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 16, 2015

Filed

Apr 22, 2015

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Freedom Smokes, Inc. →2 incidents on file

Freedom Smokes, Inc. disclosed that unauthorized code was found on its MyFreedomSmokes website on March 16, 2015, potentially allowing access to customer data entered between February 11 and March 16, 2015. Affected data may include names, addresses, emails, phone numbers, and credit card details (number, expiration, CVV). The company removed the code, engaged a cybersecurity firm, and enhanced website security.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 16, 2015 → Notified Apr 1, 201516d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 33 days

discovery → filing · 5 weeks / 37 days

Feb 11, 2015

Begins

Mar 16, 2015

Discovered

Apr 22, 2015

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_db95a0ed87fc82952015-04-22Verified
Massachusetts State AGbd_c007487a37c332832015-04-23 · +1dVerified

Name: Freedom Smokes, Inc.
norm: freedom smokes

Name: Freedom Smokes, Inc.
norm: freedom smokes
Industry: Retail & Consumerllm

Discovered: Mar 16, 2015
Breach occurred: Feb 11, 2015 – Mar 16, 2015
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Removed the unauthorized code from the website
Retained the services of a nationally recognized cyber security firm
Engaged in enhancements to the security of our website
Changed its process for taking orders online and has moved to an enhanced system to protect customer information
Changes made: Engaged in enhancements to the security of our website
Changed its process for taking orders online and has moved to an enhanced system to protect customer information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 16, 2015
→ Notified: Apr 1, 2015
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 16, 2015 → Notified: Apr 1, 2015	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 22 · first

California State AGApr 22 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-55579
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2015
Raw hash: 85565dfb785a0f91baf29d6dd2a050bb104a66dbeebdf917f199ec68d67ca066

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFreedom Smokes, Inc.

Victim entityFreedom Smokes, Inc.

Incidentdiscovered Mar 16, 2015

Stated responseRemoved the unauthorized code from the website

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov