HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryFinancial accountFinancial credentialsIdentity (basic)LowContained

HRM Enterprises, Inc.

bd_94fb78a9de5c5ab7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 8, 2023

Filed

Jul 26, 2023

To disclose

7 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

64%

Full breach record for HRM Enterprises, Inc. →

HRM Enterprises, Inc. notified customers that its e-commerce provider, CommerceV3, suffered an unauthorized access incident between Nov 24, 2021, and Dec 14, 2022. Payment card information (name, card number, CVV, expiration, billing address, email) was potentially accessed. HRM was notified on June 8, 2023. The company is reviewing vendor requirements and policies.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 8, 2023 → Notified Jul 26, 202348d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 561 days

discovery → filing · 7 weeks / 48 days

Nov 24, 2021

Begins

Jun 8, 2023

Discovered

Jul 26, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_08ea0397a9df91962023-07-26Candidate
Montana State AGbd_3a4d93abf89c88112023-07-26Verified by operator
Vermont State AGbd_a134805f0dacc9b62023-07-26Verified
Maine State AGbd_a81a49dc0137c4af2023-07-26Verified

Show 2 more filings ↓

Oregon State AGbd_eb539a02510cc87b2023-07-26Verified by operator
Indiana State AGbd_f7715c0d560006ea2023-07-26Verified by operator

Name: HRM Enterprises, Inc.
norm: hrm enterprises

Name: HRM Enterprises, Inc.
norm: hrm enterprises
Industry: Retail & Consumerllm

Discovered: Jun 8, 2023
Breach occurred: Nov 24, 2021 – Dec 14, 2022
Undetected for: 561 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2023
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via CommerceV3
Initial access: supply_chain

During the incident: Investigated upon being notified by CommerceV3
Worked with CommerceV3 to obtain additional information about the event
Assessed any risk to payment information
Communicated with CommerceV3 for additional information about the incident
Changes made: Reviewing processes and policies
Updating vendor technical requirements
Reassessing relationships with vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: CA 60-day OK · 48d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 8, 2023
→ Notified: Jul 26, 2023
48d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 8, 2023 → Notified: Jul 26, 2023	48d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGJul 26 · first

Montana State AGJul 26 · first

Vermont State AGJul 26 · first

Maine State AGJul 26 · first

Oregon State AGJul 26 · first

Indiana State AGJul 26 · first

California State AGJul 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570884
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2023
Raw hash: 913e00d8368ff14c04d13f64785917c8414d721606fdac30da35048514a5b16d

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityHRM Enterprises, Inc.

Victim entityHRM Enterprises, Inc.

Incidentdiscovered Jun 8, 2023

Stated responseInvestigated upon being notified by CommerceV3

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov