HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountCredentialsLowContained

STC Holdings LLC

bd_5f342a4f10d596f1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2024

Filed

Dec 2, 2024

To disclose

24 days

Affected

Not disclosed

Linked

6 filings

Confidence

64%

STC Holdings (via TobaccoPipes.com) notified consumers of a data breach caused by a compromised third-party application (FreshClick) on its BigCommerce platform. The incident, occurring between Oct 15 and Nov 7, 2024, involved skimming of credit card information. STC Holdings uninstalled the app, secured systems, and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday24 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 24 days

discovery → filing · 24 days

Oct 15, 2024

Begins

Nov 8, 2024

Discovered

Dec 2, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_11707656521ddf0f2024-11-28 · +4dVerified
Maine State AGbd_f0cbd526669bc7082024-11-28 · +4dVerified
Montana State AGbd_e11fc2bc71477d0e2024-11-27 · +5dCandidate
Indiana State AGbd_f6e6a68a365e70d42024-11-27 · +5dVerified

Show 1 more filing ↓up to 7d gap

New Hampshire State AGbd_ff0dcc59156008642024-12-09 · +7dVerified

Name: STC Holdings LLC
norm: stc holdings

Name: STC Holdings LLC
norm: stc holdings
Domain: tobaccopipes.com
Also named: STC Holdingsoperating subsidiary ofholding company
Industry: Retail & Consumerllm

Discovered: Nov 8, 2024
Breach occurred: Oct 15, 2024 – Nov 7, 2024
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2024
Affected individuals: Not disclosed
Data types: Financial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notifying relevant government agencies in accordance with applicable data privacy laws
Third party: via BigCommerce / FreshClick
Initial access: supply_chain

During the incident: Immediately uninstalled the compromised third-party application from our ecommerce website
Secured our systems to prevent further unauthorized access
Engaging security experts to conduct an independent forensics investigation
Notifying relevant government agencies in accordance with applicable data privacy laws
Notifying individuals, like yourself, whose information may have been compromised
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 27 · first

Indiana State AGNov 27 · first

Massachusetts State AG+1d

Maine State AG+1d

Vermont State AG+5d · this page

New Hampshire State AG+12d

Pattern: first filing Nov 27 (MT), last Dec 9 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-12-02-stc-holdings-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2024
Raw hash: b2625a8e508ca1865b50e3b981b57907dc337b4208af9c680880b24c371c74e3

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTC Holdings LLC

Victim entitySTC Holdings LLC

Incidentdiscovered Nov 8, 2024

Stated responseImmediately uninstalled the compromised third-party application from our ecommerce website

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov