HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Hawaii Coffee Company LLC

bd_8b040a24556f5d95 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 14, 2023

Filed

Sep 25, 2023

To disclose

15 weeks

Affected

14state residents only

Linked

5 filings

Confidence

65%

Full breach record for Hawaii Coffee Company LLC →

Hawaii Coffee Company notified customers that BigCommerce, its e-commerce platform provider, experienced unauthorized access to its systems between Feb 14 and Mar 22, 2023. The incident may have exposed customer names, emails, and payment card details. Hawaii Coffee Company secured its network and reviewed transactions.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 120 days

discovery → filing · 15 weeks / 103 days

Feb 14, 2023

Begins

Jun 14, 2023

Discovered

Sep 25, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_84527d59a61992ba2023-09-25Verified
New Hampshire State AGbd_0aff9f941d00defb2023-09-26 · +1dVerified
Massachusetts State AGbd_187a14508c9393af2023-09-26 · +1dVerified
Maine State AGbd_747493305017ba2d2023-09-26 · +1dCandidate

Name: Hawaii Coffee Company LLC
norm: hawaii coffee

Name: Hawaii Coffee Company LLC
norm: hawaii coffee
Industry: Retail & Consumerllm

Discovered: Jun 14, 2023
Breach occurred: Feb 14, 2023 – Mar 22, 2023
Undetected for: 120 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2023
Affected individuals: 14state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Third party: via BigCommerce
Initial access: valid_credentials

During the incident: Took steps to secure our network
Commenced our own investigation
Review of all transactions that took place during this incident
Changes made: Implementing additional safeguards and security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 25 · first

Montana State AGSep 25 · first · this page

New Hampshire State AG+1d

Massachusetts State AG+1d

Maine State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-720.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2023
Raw hash: 6aef4a6d7f24edd1faaad2be683dc0839889f0c033ef0de6647b639fb9179417

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityHawaii Coffee Company LLC

Victim entityHawaii Coffee Company LLC

Incidentdiscovered Jun 14, 2023

Stated responseTook steps to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov