HackingRetail & ConsumerRetailVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Smithfield Specialty Foods Group

bd_92f0fc575267329b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 7, 2023

Filed

Jun 29, 2023

To disclose

22 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Smithfield Specialty Foods Group →

Smithfield Specialty Foods Group LLC notified customers of a data breach affecting its online accounts hosted by third-party provider CommerceV3, Inc. Unauthorized access occurred between Nov 24, 2021, and Dec 14, 2022, and was discovered on June 7, 2023. Exposed data included names, billing addresses, emails, and payment card details (numbers, expiration dates, security codes). Smithfield suspended impacted services and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 7, 2023 → Notified Jun 29, 202322d ✓ CA 60-day OK22 days discovery → filing

Incident timeline

undetected · 560 days

discovery → filing · 22 days

Nov 24, 2021

Begins

Jun 7, 2023

Discovered

Jun 29, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_3763642991c869a42023-06-29Candidate

Name: Smithfield Specialty Foods Group
norm: smithfield specialty foods

Name: Smithfield Specialty Foods Group
norm: smithfield specialty foods
Industry: Retail & Consumerllm

Discovered: Jun 7, 2023
Breach occurred: Nov 24, 2021 – Dec 14, 2022
Undetected for: 560 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 29, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via CommerceV3, Inc.
Initial access: supply_chain

During the incident: Suspended the impacted functionality of the third-party web hosting service
Working with CV3 to address this issue
Offering all affected customers one year of complimentary credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: CA 60-day OK · 22d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 7, 2023
→ Notified: Jun 29, 2023
22d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 7, 2023 → Notified: Jun 29, 2023	22d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGJun 29 · first

California State AGJun 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568673
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2023
Raw hash: 3e7181e722251f54df1334a99714b0b9d7d7412165c86b3dfbbf454eaa9f592c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySmithfield Specialty Foods Group

Victim entitySmithfield Specialty Foods Group

Incidentdiscovered Jun 7, 2023

Stated responseSuspended the impacted functionality of the third-party web hosting service

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov