HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedData ExfiltratedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

1873349 Ontario, Inc.

bd_66df778123252fe4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 30, 2018

Filed

Nov 30, 2018

To disclose

4 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for 1873349 Ontario, Inc. →

1873349 Ontario, Inc. disclosed unauthorized access to payment card data on its Canadian website (1800Flowers.ca) between August 15, 2014, and September 15, 2018. The incident was discovered on October 30, 2018. Affected data includes names, payment card numbers, expiration dates, and security codes. The company disabled the site, engaged forensic investigators, and redesigned the website with additional security measures.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date4 weeks discovery → filing

Incident timeline

undetected · 1537 days

discovery → filing · 4 weeks / 31 days

Aug 15, 2014

Begins

Oct 30, 2018

Discovered

Nov 30, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_b9636a23de596e192018-11-30Verified
Massachusetts State AGbd_c3a1c615e7277b982018-11-30Verified
New Hampshire State AGbd_5f62021acd59680e2018-12-03 · +3dVerified

Name: 1873349 Ontario, Inc.
norm: 1873349 ontario
Domain: 1800flowers.ca

Name: 1873349 Ontario, Inc.
norm: 1873349 ontario
Domain: 1800flowers.ca
Industry: Retail & Consumerllm

Discovered: Oct 30, 2018
Breach occurred: Aug 15, 2014 – Sep 15, 2018
Undetected for: 1,537 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2018
Affected individuals: Not disclosed
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Disabled the website
Began an investigation with the assistance of a leading computer security firm
Working with the payment card networks so that banks and other entities that issue payment cards can be made aware
Changes made: Redesigned the Canadian Website
Implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGNov 30 · first

Massachusetts State AGNov 30 · first

California State AGNov 30 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142249
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2018
Raw hash: 7545ccae716a193985cebd69aa80fe623c9d04b9d7fd2d87e67c4704bb699a81

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entity1873349 Ontario, Inc.

Victim entity1873349 Ontario, Inc.

Incidentdiscovered Oct 30, 2018

Stated responseDisabled the website

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov