HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIFinancial accountIdentity (basic)LowContained

Best Buy Co., Inc.

bd_935b6af16c9aadf6 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 12, 2018

To disclose

—

Affected

711state residents only

Linked

6 filings

Confidence

64%

Full breach record for Best Buy Co., Inc. →5 incidents on file

Best Buy Co., Inc. notified Montana residents of a data breach involving third-party vendor [24]7.ai. Malicious code inserted in vendor software between Sept 26 and Oct 12, 2017, allowed unauthorized access to customer payment card data (names, addresses, card numbers, CVV) for BestBuy.com shoppers during that period. Best Buy engaged forensic experts, removed the code, and offered one year of Identity Guard credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 26, 2017

Begins

Apr 12, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Part of [24]7.ai supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3d9c5856ad205a4c2018-04-13 · +1dVerified by operator
Massachusetts State AGbd_8fa5e4e8d23657b22018-04-13 · +1dVerified
California State AGbd_abf1ad4c92fe52282018-04-13 · +1dVerified
New Hampshire State AGbd_aed67aaeddf0751b2018-04-13 · +1dVerified

Show 1 more filing ↓up to 13d gap

Oregon State AGbd_3127e7742cdefbe02018-04-25 · +13dVerified

Name: Best Buy Co., Inc.
norm: best buy

Name: Best Buy Co., Inc.
norm: best buy
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 26, 2017 – Oct 12, 2017
Materiality determined: —
Notification sent: Apr 12, 2018
Affected individuals: 711state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via [24]7.ai
Initial access: supply_chain

During the incident: Engaged leading data security experts to assist with the investigation
Confirmed that the malicious code had been removed from its software
Confirmed that the unauthorized access had been stopped
Made changes to how the (24]7.ai software operates on our site
Arranged with Identity Guard to provide identity theft services
Changes made: Changed how the (24]7.ai software operates on our site
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGApr 12 · first · this page

Washington State AG+1d

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+1d

Oregon State AG+13d

Pattern: first filing Apr 12 (MT), last Apr 25 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Best-Buy.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2018
Raw hash: d3b93fe141580200dd91a07e730ea29b0c8ae63bb146bc33ad2d4635e8ace2d3

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBest Buy Co., Inc.

Victim entityBest Buy Co., Inc.

IncidentThird-Party / Supply Chain

Stated responseEngaged leading data security experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov