HackingSkimmerStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PCIFINANCIAL_ACCOUNTPIIMediumContained
John and Kira's Chocolates
bd_86918de2d1139fb7 · schema v1 · pii pii-v1
Full breach record for John and Kira's Chocolates →John and Kira’s Chocolates reported a data breach affecting its third-party e-commerce platform, CommerceV3. Unauthorized access occurred between November 24, 2021, and July 1, 2022, via a skimmer attack. The breach potentially exposed payment card information and personal data of 9,328 customers, including 72 in New Hampshire. CommerceV3 conducted a forensic investigation and implemented security upgrades, including tokenization.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_a8ee0c29e7059cf1California State AGfiled 2023-06-15Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/john-kiras-chocolates-20230615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 15, 2023
- Raw hash
- 4ff394eac95468e55a83da4c0da85eb0334a689fa67b25456144eeab5148e6c9
Reporting entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Victim entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Incident
- Discovered
- Jun 6, 2023
- Materiality determined
- May 3, 2023
- Notification sent
- Jun 19, 2023
- Affected individuals
- 9,328
- Data types
- PCIFINANCIAL_ACCOUNTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Reporting this incident as a data breach to various state and regulatory agencies across the country
- Third party
- via CommerceV3
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 days(9 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.