HackingVulnerability ExploitData ExfiltratedTargetedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowContained
General Wax and Candle Company
bd_527e8d365d8f0e34 · schema v1 · pii pii-v1
Full breach record for General Wax and Candle Company →General Wax & Candle Company experienced a data breach where malicious code was injected into its retail website checkout page, capturing customer payment card data, names, and contact info between Feb 16 and Mar 2, 2023. The company engaged forensic investigators, removed the code, and implemented enhanced security safeguards. No specific count of affected individuals was disclosed in the filing.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_d1fb306156627e21Maine State AGfiled 2023-05-19(9d gap)Candidate
- bd_e91f73e4681fa00aMontana State AGfiled 2023-05-19(9d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-05-10-general-wax-candle-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 10, 2023
- Raw hash
- 54047c34c0f849b580d8ec4915ca9c891b7388b996415bbcc279ea5b7b91586b
Reporting entity
- Name
- General Wax and Candle Companynorm: general wax and candle
Victim entity
- Name
- General Wax and Candle Companynorm: general wax and candle
Incident
- Discovered
- Feb 16, 2023
- Materiality determined
- May 10, 2023
- Notification sent
- May 10, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1056 Input Capture
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 12 weeks(83 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.