PhysicalRetail & ConsumerRetailTheftEmployee Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDEmploymentMediumContained

PETCO Animal Supplies, Inc.

bd_657de2d435d27d46 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 3, 2012

Filed

Jul 26, 2012

To disclose

23 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for PETCO Animal Supplies, Inc. →

Petco Animal Supplies, Inc. notified the California Attorney General of a data breach involving five laptops stolen from its 401(k) plan's outside auditor between May 18-20, 2012. The laptops contained personal information, including names and Social Security numbers, of associates who received paychecks in 2010 or had 401(k) activity in 2011. Petco discovered the incident on July 3, 2012, when the auditor informed them. The company offered one year of free credit monitoring via Experian to affected individuals. The laptops were password-protected and encrypted, and police believed the thieves targeted the equipment rather than the data.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 3, 2012 → Notified Jul 28, 201225d ✓ CA 60-day OK23 days discovery → filing

Incident timeline

undetected · 46 days

discovery → filing · 23 days

May 18, 2012

Begins

Jul 3, 2012

Discovered

Jul 26, 2012

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_392ec2789d88283f2012-07-26Verified
Massachusetts State AGbd_16ceb346aeb0858b2012-07-27 · +1dVerified

Name: PETCO Animal Supplies, Inc.
norm: petco animal supplies

Name: PETCO Animal Supplies, Inc.
norm: petco animal supplies
Industry: Retail & Consumerllm

Discovered: Jul 3, 2012
Breach occurred: May 18, 2012 – May 20, 2012
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 28, 2012
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Reported theft to the City of San Diego Police Department
Third party: via Outside Auditor

During the incident: Offering one year of credit monitoring at no cost through Experian's ProtectMyID Alert
Providing identity protection services focused on identification and resolution of possible identity theft
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: CA 60-day OK · 25d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 3, 2012
→ Notified: Jul 28, 2012
25d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 3, 2012 → Notified: Jul 28, 2012	25d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJul 26 · first

California State AGJul 26 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-32373
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2012
Raw hash: 2981ab85ca1bea4fb3e85342101b1bc2ecc465116683083b7f7d4045ca01ecc2

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPETCO Animal Supplies, Inc.

Victim entityPETCO Animal Supplies, Inc.

Incidentdiscovered Jul 3, 2012

Stated responseOffering one year of credit monitoring at no cost through Experian's ProtectMyID Alert

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov