HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICPIILowContained
SPECTRUM BRANDS, INC.
bd_5df448f141979973 · schema v1 · pii pii-v1
Full breach record for SPECTRUM BRANDS, INC. →Spectrum Brands, Inc. notified consumers of a data breach involving its employee wellness platform, CaféWell, operated by third-party vendor Welltok, Inc. An unknown actor exploited a vulnerability in MOVEit file transfer software between May 30-31, 2023. Impacted data included names, addresses, phone numbers, and email addresses. Welltok applied patches, engaged forensic specialists, notified law enforcement, and offered 24 months of credit monitoring via Experian.
Vermont clock✗ VT AG >45 bday13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_835069d60ee13a0fMaine State AGfiled 2023-11-10(3d gap)Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-11-13-spectrum-brands-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 13, 2023
- Raw hash
- ec32c06eb773ee90931aa98c5cde0a2475be84d2b23146206421b254f1ec61ad
Reporting entity
- Name
- Welltoknorm: welltok
- Domain
- welltok.com
Victim entity
- Name
- SPECTRUM BRANDS, INC.norm: spectrum brands
Incident
- Discovered
- Aug 11, 2023
- Materiality determined
- —
- Notification sent
- Nov 13, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Welltok, Inc.
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 weeks(94 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.