HackingRetail & ConsumerRetailTargetedIdentity (basic)Financial accountMediumResolved

Sugarfina USA, LLC

bd_5ca080b9a6988def · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2021

Filed

May 25, 2021

To disclose

19 weeks

Affected · nationwide

39,79473 in this filing

Linked

9 filings

Confidence

66%

Full breach record for Sugarfina USA, LLC →

Sugarfina USA, LLC reported an external system breach occurring between November 1, 2019, and September 3, 2020. Discovered on January 15, 2021, the incident compromised names and financial account numbers (including credit/debit card numbers with security codes/PINs) for 39,794 individuals, including 73 Maine residents. Written notification was sent on May 25, 2021. No identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 15, 2021 → Filed with AG May 25, 2021130d ✗ ME AG >90d19 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 441 days

discovery → filing · 19 weeks / 130 days

Nov 1, 2019

Begins

Jan 15, 2021

Discovered

May 25, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_8fd4aa394c9b33e92021-05-25Verified
California State AGbd_9ef0158eb8fcad352021-05-25Verified
Oregon State AGbd_af6dc0ec43bde3f12021-05-25Verified
Indiana State AGbd_b2b0346c19ea77922021-05-25Verified

Show 4 more filings ↓up to 144d gap

Montana State AGbd_cbbc835a8a32a5592021-05-25Verified
Washington State AGbd_ce2b887a3ceb24d22021-05-25Verified
New Hampshire State AGbd_2dd44e96e01783982021-06-01 · +7dVerified
Illinois State AGbd_ea98cd3f8d09cd7d2021-01-01 · +144dCandidate

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com
Industry: Retail & Consumerllm

Discovered: Jan 15, 2021
Breach occurred: Nov 1, 2019 – Sep 3, 2020
Undetected for: 441 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2021
Affected individuals: 39,794state + nationwide
Data types: Identity (basic)Financial account
Data elements: Financial account number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: ME AG >90d · 130d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 15, 2021
→ Filed with AG: May 25, 2021
130d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 15, 2021 → Filed with AG: May 25, 2021	130d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+144d

California State AG+144d

Oregon State AG+144d

Indiana State AG+144d

Montana State AG+144d

Washington State AG+144d

Maine State AG+144d · this page

New Hampshire State AG+151d

Pattern: first filing Jan 1 (IL), last Jun 1 (NH) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/565b2f13-c3eb-42e6-8eca-30fa9a041d83.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2021
Raw hash: 9f5ef9a831ae89c275564f82cd71f44ca4fa424c4711451e60400122c0940ed6

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySugarfina USA, LLC

Victim entitySugarfina USA, LLC

Incidentdiscovered Jan 15, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov