HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Employee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

MONDELEZ GLOBAL LLC

bd_820d6b50821eff43 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 27, 2023

Filed

Jun 20, 2023

To disclose

16 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for MONDELEZ GLOBAL LLC →2 incidents on file

Mondelez Global LLC notified employees of a data breach involving their law firm, Bryan Cave Leighton Paisner LLP. Unauthorized access to Bryan Cave's systems occurred between February 23 and March 1, 2023, and was detected on February 27, 2023. The incident exposed personal information of current and former employees, including Social Security numbers, names, addresses, dates of birth, and retirement plan information. Mondelez offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 27, 2023 → Notified Jun 15, 2023108d ✗ CA 60-day late16 weeks discovery → filing

Incident timeline

undetected · 4 days

discovery → filing · 16 weeks / 113 days

Feb 23, 2023

Begins

Feb 27, 2023

Discovered

Jun 20, 2023

Filed

vs. sector median

+9 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Washington State AGbd_8fc3c30a7b89ff662023-06-20Verified
Massachusetts State AGbd_9029a5f2cbb43df92023-06-21 · +1dVerified
Oregon State AGbd_b7de965a48342f552023-06-19 · +1dVerified
Indiana State AGbd_090c9c69f0de7e6c2023-06-15 · +5dVerified

Show 4 more filings ↓up to 170d gap

Maine State AGbd_a4506857adbf9ea72023-06-15 · +5dVerified
Montana State AGbd_f49f3eaaf355d3872023-06-15 · +5dVerified
New Hampshire State AGbd_fac3e2b9089e310c2023-06-15 · +5dVerified
Illinois State AGbd_74cb79fa04fbbaf12023-01-01 · +170dCandidate

Name: MONDELEZ GLOBAL LLC
norm: mondelez global

Name: MONDELEZ GLOBAL LLC
norm: mondelez global
Industry: Retail & Consumerllm

Discovered: Feb 27, 2023
Breach occurred: Feb 23, 2023 – Mar 1, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2023
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Bryan Cave Leighton Paisner LLP
Initial access: trusted_relationship

During the incident: Bryan Cave initiated a robust investigation with the assistance of an outside cybersecurity forensics firm
Bryan Cave notified law enforcement
Mondelēz is providing notice and offering credit monitoring services to individuals based on the personal information that was potentially impacted
Changes made: Bryan Cave informed us that they have taken steps to address the incident and prevent a similar occurrence in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: CA 60-day late · 108d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 27, 2023
→ Notified: Jun 15, 2023
108d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 27, 2023 → Notified: Jun 15, 2023	108d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+165d

Maine State AG+165d

Montana State AG+165d

New Hampshire State AG+165d

Oregon State AG+169d

Washington State AG+170d

California State AG+170d · this page

Massachusetts State AG+171d

Pattern: first filing Jan 1 (IL), last Jun 21 (MA) — a 171-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568259
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2023
Raw hash: 7769aecd9692820d2d9c54e85b56e0cf5795bf3ceac602150c821ab8ef86424a

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMONDELEZ GLOBAL LLC

Victim entityMONDELEZ GLOBAL LLC

Incidentdiscovered Feb 27, 2023

Stated responseBryan Cave initiated a robust investigation with the assistance of an outside cybersecurity forensics firm

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov