AccidentalRetail & ConsumerRetailMisdeliveryCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

CBD Industries, LLC

bd_9aa958396af95c6c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 19, 2021

Filed

Mar 4, 2021

To disclose

6 weeks

Affected · nationwide

33213 in this filing

Linked

4 filings

Confidence

65%

Full breach record for CBD Industries, LLC →3 incidents on file

CBD Industries, LLC, an online retailer, issued a supplemental notice to the New Hampshire Attorney General regarding a data event involving malicious code on its eCommerce platforms (hempsynergy.com, pawcbd.com). The code, inserted between March 30 and May 18, 2020, risked skimming customer transaction data including names, emails, billing addresses, credit/debit card numbers, and bank account numbers. The incident was discovered on January 19, 2021. 332 individuals nationwide were at risk, including 13 New Hampshire residents. CBD Industries notified federal law enforcement, provided one year of TransUnion credit monitoring, and implemented additional technical security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 295 days

discovery → filing · 6 weeks / 44 days

Mar 30, 2020

Begins

Jan 19, 2021

Discovered

Mar 4, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_26158aa12c9a0bb42021-02-23 · +9dCandidate
Montana State AGbd_2a18144f30a819d72021-02-23 · +9dVerified by operator
Illinois State AGbd_67bcd37dcfdad27d2021-01-01 · +62dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: CBD Industries, LLC
norm: cbd industries
Industry: retail_consumer
Industry: Retail & Consumerllm

Discovered: Jan 19, 2021
Breach occurred: Mar 30, 2020 – May 18, 2020
Undetected for: 295 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2021
Affected individuals: 332state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement and has cooperated with its investigation
Initial access: exploit_public_facing

During the incident: Notified federal law enforcement and has cooperated with its investigation
Provided access to credit monitoring services for one (1) year, through TransUnion, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided notified individuals with guidance on how to better protect against identity theft and fraud
Provided individuals with information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Encouraged individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement
Changes made: Secured TransUnion to provide identity monitoring at no cost to you for one (1) year
Implemented additional technical security measures designed to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+53d

Montana State AG+53d

New Hampshire State AG+62d · this page

Pattern: first filing Jan 1 (IL), last Mar 4 (NH) — a 62-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cbd-industries-20210304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2021
Raw hash: b46ad215174b45af3884687ff245b7239388e5873a41c39da108451672514de6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCBD Industries, LLC

Incidentdiscovered Jan 19, 2021

Stated responseNotified federal law enforcement and has cooperated with its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov