PhysicalRetail & ConsumerRetailSkimmerEmployee Data InvolvedTargetedFinancial accountPCILowContained

Best Buy Co., Inc.

bd_6f71b1bccc086dc7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 5, 2009

Filed

Feb 2, 2009

To disclose

28 days

Affected

1state residents only

Confidence

66%

Full breach record for Best Buy Co., Inc. →5 incidents on file

Best Buy notified New Hampshire of a credit card skimming incident at a West Palm Beach, FL store. An employee used a handheld skimmer to steal card info in Nov-Dec 2008. Best Buy discovered the incident on Jan 5, 2009, and notified the Secret Service. One NH resident was affected. Best Buy provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 65 days

discovery → filing · 28 days

Nov 1, 2008

Begins

Jan 5, 2009

Discovered

Feb 2, 2009

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Best Buy Co., Inc.
norm: best buy

Name: Best Buy Co., Inc.
norm: best buy
Industry: Retail & Consumerllm

Discovered: Jan 5, 2009
Breach occurred: Nov 1, 2008 – Dec 31, 2008
Undetected for: 65 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 4, 2009
Affected individuals: 1state-resident count only
Data types: Financial accountPCI
Attack vector: Insider
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: InternalFinancial
Regulator citations: Informed Federal law enforcement authorities, including the Secret ServiceInformed all relevant payment card brands of the incident
Initial access: insider_action

During the incident: Informed Federal law enforcement authorities, including the Secret Service, and cooperated fully with their investigations
Informed all relevant payment card brands of the incident, and cooperated fully with each of them
Conducted an internal investigation of the incident
Carefully reviewed our processes to reduce even further the chance that an incident such as this could happen again
Issued special advisories to store management concerning this type of threat
Sent by First Class US Mail, beginning on or about February 4, 2009, written notice of the incident to each of the affected customers
Provided each of them with one year of premium credit monitoring services at no charge
Changes made: Carefully reviewed our processes to reduce even further the chance that an incident such as this could happen again
Issued special advisories to store management concerning this type of threat
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/best-buy-20090202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2009
Raw hash: 97c9fd324cc720c7141fab6175a389f39062ad574ba5bc1101610e1c156418fb

Reporting entityBest Buy Co., Inc.

Victim entityBest Buy Co., Inc.

Incidentdiscovered Jan 5, 2009

Stated responseInformed Federal law enforcement authorities, including the Secret Service, and cooperated fully with their investigations

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov