HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

MarketPlace: Handwork of India

bd_92faa74eccb78f02 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 6, 2023

Filed

Sep 12, 2023

To disclose

14 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for MarketPlace: Handwork of India →2 incidents on file

MarketPlace Handwork of India notified customers of a data breach involving its third-party e-commerce platform, CommerceV3. An unauthorized party accessed CommerceV3 systems between November 24, 2021, and December 14, 2022. MarketPlace India was notified on June 6, 2023. Affected data may include names, email addresses, billing addresses, payment card numbers, expiration dates, and security codes. The company implemented additional security measures and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 6, 2023 → Notified Sep 11, 202397d ✗ CA 60-day late14 weeks discovery → filing

Incident timeline

undetected · 559 days

discovery → filing · 14 weeks / 98 days

Nov 24, 2021

Begins

Jun 6, 2023

Discovered

Sep 12, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 6 about the same incident.View merged incident

Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_0b6401102608e4552023-09-11 · +1dVerified
Oregon State AGbd_d42937317e38b72a2023-09-11 · +1dCandidate
Maine State AGbd_fb18a94c3350429b2023-09-11 · +1dVerified
Indiana State AGbd_ff4b32098cea51532023-09-11 · +1dVerified

Show 1 more filing ↓up to 6d gap

New Hampshire State AGbd_02484d172a0747422023-09-18 · +6dVerified

Name: MarketPlace: Handwork of India
norm: marketplace handwork of india

Name: MarketPlace: Handwork of India
norm: marketplace handwork of india
Industry: Retail & Consumerllm

Discovered: Jun 6, 2023
Breach occurred: Nov 24, 2021 – Dec 14, 2022
Undetected for: 559 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via CommerceV3

During the incident: Conducted a thorough forensic investigation alongside third-party cybersecurity experts
Worked alongside the major card brands and banks during this investigation
Worked diligently with our credit card processor to begin an in-depth review of our internal records
Implemented additional security measures within its network and facilities
Reviewing its current policies and procedures related to data security
Arranged for complimentary online credit monitoring service for twelve (12) months through Cyberscout
Changes made: Implemented additional security measures within its network and facilities
Reviewing its current policies and procedures related to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: CA 60-day late · 97d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 6, 2023
→ Notified: Sep 11, 2023
97d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 6, 2023 → Notified: Sep 11, 2023	97d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGSep 11 · first

Oregon State AGSep 11 · first

Maine State AGSep 11 · first

Indiana State AGSep 11 · first

California State AG+1d · this page

New Hampshire State AG+7d

Pattern: first filing Sep 11 (VT), last Sep 18 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-573126
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 12, 2023
Raw hash: 6e1831d77b4e6f58282f8b8c9f031bad35a72422d5e949f89d743e497f13297e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMarketPlace: Handwork of India

Victim entityMarketPlace: Handwork of India

Incidentdiscovered Jun 6, 2023

Stated responseConducted a thorough forensic investigation alongside third-party cybersecurity experts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov