HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedPIIFinancial accountIdentity (basic)LowContained

BOB'S RED MILL NATURAL FOODS, INC.

bd_933ee2b9af26142e · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2022

Filed

Apr 15, 2022

To disclose

6 weeks

Affected

8state residents only

Linked

15 filings

Confidence

63%

Full breach record for BOB'S RED MILL NATURAL FOODS, INC. →

Bob's Red Mill Natural Foods, Inc. notified customers of a data breach occurring between Feb 23 and Mar 1, 2022. Malicious software scraped payment card numbers, CVVs, and PII from its website. The company investigated, removed the malware, and notified payment processors and card brands. Fraudulent charges were reported by customers, suggesting data acquisition.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 6 weeks / 45 days

Feb 23, 2022

Begins

Mar 1, 2022

Discovered

Apr 15, 2022

Filed

vs. sector median

2 wks faster

This filing is one of 15 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_145b8bd7a6923e072022-04-15Verified
Maine State AGbd_b9fb048eefc08f012022-04-15Verified
Maine State AGbd_03dabe7d25bc43d02022-04-12 · +3dVerified
Massachusetts State AGbd_dcd71ea5c18373b02022-04-20 · +5dVerified

Show 6 more filings ↓up to 99d gap

Indiana State AGbd_3a1fb212b8affff72022-04-22 · +7dVerified
New Hampshire State AGbd_c2771f0f144138e42022-01-24 · +81dVerified
Maine State AGbd_e2fee1411f242afb2022-01-19 · +86dVerified
Indiana State AGbd_e862f05ab79a3f792022-01-18 · +87dVerified
New Hampshire State AGbd_33c28cc606982e302022-01-07 · +98dVerified
Maine State AGbd_380a45d9f2b5d41e2022-01-06 · +99dVerified

Showing first 10 of 14 linked disclosures.

Name: BOB'S RED MILL NATURAL FOODS, INC.
norm: bob s red mill natural foods
Domain: bobsredmill.com

Name: BOB'S RED MILL NATURAL FOODS, INC.
norm: bob s red mill natural foods
Domain: bobsredmill.com
Industry: Retail & Consumerllm

Discovered: Mar 1, 2022
Breach occurred: Feb 23, 2022 – Mar 1, 2022
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1056 Input CaptureT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Began an investigation and took steps to fix the problem
Isolated and removed the malicious software
Notified, and will work with, our payment processor
Notified the payment-card brands we work with (American Express, Discover, Mastercard, and Visa)
Changes made: Use the information uncovered during our investigation to further bolster our data security and incident-response processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Maine State AGJan 6 · first

New Hampshire State AG+1d

Indiana State AG+12d

Maine State AG+13d

New Hampshire State AG+18d

Maine State AG+96d

New Hampshire State AG+99d

Maine State AG+99d

Montana State AG+99d · this page

Massachusetts State AG+104d

Indiana State AG+106d

Pattern: first filing Jan 6 (ME), last Apr 22 (IN) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Bobs-Red-Mill-Natural-Foods-Inc.-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2022
Raw hash: 2c84930860d28c3bf3f0189cdb788ebc7277d672ac5a3b6cdc9d257ca4e3c945

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityBOB'S RED MILL NATURAL FOODS, INC.

Victim entityBOB'S RED MILL NATURAL FOODS, INC.

Incidentdiscovered Mar 1, 2022

Stated responseBegan an investigation and took steps to fix the problem

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov