HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDPHIHealth (basic)HighContained

Stiiizy Inc

bd_949f0ceb6ea5db5a · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 20, 2024

Filed

Dec 20, 2024

To disclose

4 weeks

Affected

3,500state residents only

Linked

10 filings

Confidence

67%

Full breach record for Stiiizy Inc →

Stiiizy, Inc. reported a data breach affecting customers at four California retail locations. A third-party POS vendor notified Stiiizy on November 20, 2024, that an organized cybercrime group had compromised accounts and acquired customer data between October 10 and November 10, 2024. Compromised data included names, addresses, driver's license numbers, and transaction histories. Stiiizy notified law enforcement and provided 12 months of free credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 41 days

discovery → filing · 4 weeks / 30 days

Oct 10, 2024

Begins

Nov 20, 2024

Discovered

Dec 20, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteeverestbd_3d72d8f2b6dda7782024-11-24 · +25dVerified by operator

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_ddcff6b1f50a788f2024-12-31 · +11dVerified by operator
Illinois State AGbd_9edc660b072a82662025-01-01 · +12dVerified
Nebraska State AGbd_557f472be0e22b0c2025-01-08 · +19dVerified
Montana State AGbd_798a4ba279e869652025-01-08 · +19dVerified by operator

Show 4 more filings ↓up to 39d gap

California State AGbd_99313b432eacb90b2025-01-08 · +19dVerified
Maine State AGbd_3408bc4c56c5ec172025-01-09 · +20dVerified
Massachusetts State AGbd_c87296d4ac4525e12025-01-09 · +20dVerified
Oregon State AGbd_e4deed8b915421cd2025-01-28 · +39dVerified by operator

Name: Stiiizy Inc
norm: stiiizy
Domain: stiiizy.com

Name: Stiiizy Inc
norm: stiiizy
Domain: stiiizy.com
Industry: Retail & Consumerllm

Discovered: Nov 20, 2024
Breach occurred: Oct 10, 2024 – Nov 10, 2024
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 8, 2025
Affected individuals: 3,500state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameDriver's licence numberDate of birthPassport numberMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement of the incident
Initial access: valid_credentials

During the incident: Launched its own investigation to assess the extent of the impact
Working closely with the vendor and legal counsel to address the situation
Notified law enforcement of the incident
Providing affected individuals with free credit monitoring services
Changes made: Implemented additional security measures designed to prevent a recurrence of such an attack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Washington State AGDec 20 · first · this page

Oregon State AG+11d

Illinois State AG+12d

Nebraska State AG+19d

Montana State AG+19d

California State AG+19d

Maine State AG+20d

Massachusetts State AG+20d

Oregon State AG+39d

Pattern: first filing Dec 20 (WA), last Jan 28 (OR) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31767.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2024
Raw hash: 1b874dfe0ef4fea1e352b77d3ed8c7cba7ac03f24e4739f7b3cea68f36814999

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityStiiizy Inc

Victim entityStiiizy Inc

Incidentdiscovered Nov 20, 2024

Stated responseLaunched its own investigation to assess the extent of the impact

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com