HackingRetail & ConsumerRetailVulnerability ExploitCapture App DataData ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountFinancial credentialsPCILowActive

Freedom Smokes, Inc.

bd_8d29c1b853ecb2ef · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 5, 2017

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

83%

Full breach record for Freedom Smokes, Inc. →2 incidents on file

Freedom Smokes, Inc. (myfreedomsmokes.com) discovered that between approximately March 7 and April 25, 2017, an unauthorized individual accessed portions of their e-commerce website and inserted malicious code designed to capture payment card information (name, address, email, phone, card number, expiration date, CVV) entered during purchases. No SSNs were affected. The company engaged a cybersecurity forensics firm and notified affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 7, 2017

Begins

Jun 5, 2017

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_5f022dd30574eeff2017-06-07 · +2dCandidate
Massachusetts State AGbd_daccdf72f493b5452017-06-07 · +2dVerified

Name: Freedom Smokes, Inc.
norm: freedom smokes

Name: Freedom Smokes, Inc.
norm: freedom smokes
Domain: myfreedomsmokes.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Mar 7, 2017 – Apr 25, 2017
Materiality determined: —
Notification sent: Jun 5, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1074 Data Staged
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Conducted an internal investigation into the incident
Communicated with the vendor who hosts and operates our website to learn more about what occurred
Retained an internationally recognized cyber security and digital data forensics firm to assist in identifying the problem, fixing it, and preventing it from happening again
Changes made: Moved to a tokenization system to better protect customer information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGJun 5 · first · this page

Oregon State AG+2d

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-72375
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2017
Raw hash: 7bc589d588433bdaf35270dbeff2dc66a0889bb0457696feaf69c7e0e10e3d0b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFreedom Smokes, Inc.

Victim entityFreedom Smokes, Inc.

IncidentUnauthorized Access

Stated responseConducted an internal investigation into the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov