HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIFinancial accountFinancial credentialsLowContained

CommerceV3

bd_5268f83cdc5eed46 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 12, 2023

Filed

Jun 16, 2023

To disclose

4 days

Affected

34state residents only

Linked

4 filings

Confidence

64%

Full breach record for CommerceV3 →

John & Kira’s Chocolates notified customers that CommerceV3, its third-party e-commerce platform, experienced unauthorized access to systems processing payment card data. The incident affected customer information including names, emails, billing addresses, and payment card details (number, CVV, expiration) for orders placed between November 24, 2021, and July 1, 2022. CommerceV3 engaged forensic experts and implemented security upgrades. The investigation confirmed the threat was eliminated.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 565 days

discovery → filing · 4 days

Nov 24, 2021

Begins

Jun 12, 2023

Discovered

Jun 16, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_ec9e3970df3d1d6d2023-06-29 · +13dCandidate
South Carolina State AGbd_5204ae1e4f1bd5ab2023-07-05 · +19dVerified
Montana State AGbd_f2ed85c3d4e048542023-07-21 · +35dCandidate

Name: John & Kira’s Chocolates
norm: john kira
Domain: commercev3.com

Name: CommerceV3
norm: commercev3
Domain: commercev3.com
Industry: Retail & Consumerllm

Discovered: Jun 12, 2023
Breach occurred: Nov 24, 2021 – Jul 1, 2022
Undetected for: 565 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2023
Affected individuals: 34state-resident count only
Data types: PIIFinancial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reporting this incident as a data breach to various state and regulatory agencies across the country
Third party: via CommerceV3
Initial access: valid_credentials

During the incident: Launched a comprehensive forensic investigation with the assistance of third-party cybersecurity experts
Collaborated closely with major card brands and banks to assess the potential impact on cardholder data
Implemented a series of additional security measures to protect customer information, including upgrades on johnandkiras.com and other stores that change how payment card data is processed when orders are placed online
Changes made: Upgrades on johnandkiras.com and other stores that change how payment card data is processed when orders are placed online
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 days(4 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Montana State AGJun 16 · first · this page

Montana State AG+13d

South Carolina State AG+19d

Montana State AG+35d

Pattern: first filing Jun 16 (MT), last Jul 21 (MT) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-353.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2023
Raw hash: 51a08d96091bd8871a962a21b6c96063cece1898371e055fe45cea64c0fdd2ae

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJohn & Kira’s Chocolates

Victim entityCommerceV3

Incidentdiscovered Jun 12, 2023

Stated responseLaunched a comprehensive forensic investigation with the assistance of third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov