HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFINANCIAL_ACCOUNTCREDENTIALSLowContained
STC Holdings LLC
bd_5f342a4f10d596f1 · schema v1 · pii pii-v1
Full breach record for STC Holdings LLC →STC Holdings (via TobaccoPipes.com) notified consumers of a data breach caused by a compromised third-party application (FreshClick) on its BigCommerce platform. The incident, occurring between Oct 15 and Nov 7, 2024, involved skimming of credit card information. STC Holdings uninstalled the app, secured systems, and engaged forensic investigators.
Vermont clock⏱ VT AG >14 bday24 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_f0cbd526669bc708Maine State AGfiled 2024-11-28(4d gap)Verified
- bd_e11fc2bc71477d0eMontana State AGfiled 2024-11-27(5d gap)Candidate
- bd_f6e6a68a365e70d4Indiana State AGfiled 2024-11-27(5d gap)Verified
- bd_ff0dcc5915600864New Hampshire State AGfiled 2024-12-09(7d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-12-02-stc-holdings-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 2, 2024
- Raw hash
- b2625a8e508ca1865b50e3b981b57907dc337b4208af9c680880b24c371c74e3
Reporting entity
- Name
- STC Holdings LLCnorm: stc holdings
Victim entity
- Name
- STC Holdings LLCnorm: stc holdings
- Domain
- tobaccopipes.com
Incident
- Discovered
- Nov 8, 2024
- Materiality determined
- —
- Notification sent
- Nov 22, 2024
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTCREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1530 Data from Cloud Storage ObjectT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notifying relevant government agencies in accordance with applicable data privacy laws
- Third party
- via BigCommerce / FreshClick
- Initial access
- supply_chain
Compliance
- Time to disclose
- 24 days(24 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.