HackingRetail & ConsumerRetailCapture App DataData ExfiltratedCustomer Data InvolvedTargetedPIIPCIFINANCIALLowContained
Lee Valley Tools Ltd.
bd_6acd94e6a6fe772e · schema v1 · pii pii-v1
Full breach record for Lee Valley Tools Ltd. →Lee Valley Tools discovered on March 12, 2025 that an unauthorized party had captured credit card data (name, address, card number, expiration date, CVV) entered on its website between October 8, 2024 and March 12, 2025 via a cloud server compromise. 57,707 individuals affected nationally; 936 Maine residents. Affected individuals notified April 15, 2025 and offered 12 months of Experian credit monitoring.
Maine clockDiscovered Mar 12, 2025 → Filed with AG Apr 9, 202528d ✓ ME AG ≤30d28 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_139ccbe30b5ad883Oregon State AGfiled 2025-04-09Candidate
- bd_66a53e9ed7c3a6c6Washington State AGfiled 2025-04-09Verified
- bd_83238aebbe215bf4Texas State AGfiled 2025-06-06(58d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5e7b6e0a-fb5a-4e82-8ee5-7ebea20a15d5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 9, 2025
- Raw hash
- 7595fe799ff6707915289d03b49ce23e73f3063080033ad32012d62c85a4e858
Reporting entity
- Name
- Lee Valley Tools Ltd.norm: lee valley tools-ca
Victim entity
- Name
- Lee Valley Tools Ltd.norm: lee valley tools-ca
- Industry
- Retail & Consumerllm
Incident
- Discovered
- Mar 12, 2025
- Materiality determined
- Mar 28, 2025
- Notification sent
- Apr 15, 2025
- Affected individuals
- 936
- Data types
- PIIPCIFINANCIAL
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1185 Browser Session HijackingT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notification filed with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 28d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 12, 2025→ Filed with AG: Apr 9, 202528d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.