HackingRetail & ConsumerRetailSkimmerStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)PCIFinancial accountPIIMediumContained

John and Kira's Chocolates

bd_86918de2d1139fb7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2023

Filed

Jun 15, 2023

To disclose

9 days

Affected · nationwide

9,32872 in this filing

Linked

2 filings

Confidence

65%

Full breach record for John and Kira's Chocolates →2 incidents on file

John and Kira’s Chocolates reported a data breach affecting its third-party e-commerce platform, CommerceV3. Unauthorized access occurred between November 24, 2021, and July 1, 2022, via a skimmer attack. The breach potentially exposed payment card information and personal data of 9,328 customers, including 72 in New Hampshire. CommerceV3 conducted a forensic investigation and implemented security upgrades, including tokenization.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 559 days

discovery → filing · 9 days

Nov 24, 2021

Begins

Jun 6, 2023

Discovered

Jun 15, 2023

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_a8ee0c29e7059cf12023-06-15Candidate

Name: John and Kira's Chocolates
norm: john and kira s chocolates
Domain: johnandkiras.com

Name: John and Kira's Chocolates
norm: john and kira s chocolates
Domain: johnandkiras.com
Industry: Retail & Consumerllm

Discovered: Jun 6, 2023
Breach occurred: Nov 24, 2021 – Jul 1, 2022
Undetected for: 559 daysoccurrence → discovery
Materiality determined: May 3, 2023
Notification sent: Jun 19, 2023
Affected individuals: 9,328state + nationwide
Data types: PCIFinancial accountPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reporting this incident as a data breach to various state and regulatory agencies across the country
Third party: via CommerceV3
Initial access: exploit_public_facing

During the incident: CommerceV3 launched a comprehensive forensic investigation with the assistance of third-party cybersecurity experts
CommerceV3 collaborated closely with major card brands and banks to assess the potential impact on cardholder data
CommerceV3 implemented a series of additional security measures to protect customer information
CommerceV3 modified the OSSEC service accordingly
CommerceV3 enhanced the monitoring and refreshing process of the affected service
CommerceV3 implemented an ICC upgrade
CommerceV3 is in the process of transitioning all merchants to a fully tokenized infrastructure
Changes made: Upgrades on johnandkiras.com and other stores that change how payment card data is processed when orders are placed online
Transitioning all merchants to a fully tokenized infrastructure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGJun 15 · first

New Hampshire State AGJun 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/john-kiras-chocolates-20230615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2023
Raw hash: 4ff394eac95468e55a83da4c0da85eb0334a689fa67b25456144eeab5148e6c9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJohn and Kira's Chocolates

Victim entityJohn and Kira's Chocolates

Incidentdiscovered Jun 6, 2023

Stated responseCommerceV3 launched a comprehensive forensic investigation with the assistance of third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov