HackingRetail & ConsumerRetailCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

1-800 Flowers

bd_9e2eb599030f24d1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 15, 2016

Filed

Mar 8, 2016

To disclose

22 days

Affected

37state residents only

Linked

3 filings

Confidence

66%

Full breach record for 1-800 Flowers →

1-800-Flowers.com notified the NH Attorney General of unauthorized access to its e-commerce platform network. The incident occurred between Feb 15-17, 2016, potentially exposing name, address, email, and payment card details (including CVV) for 37 New Hampshire residents. The company initiated an investigation, contained the access, and is working with security experts to strengthen systems.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Feb 15, 2016

Begins

Feb 15, 2016

Discovered

Mar 8, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_6906b434aa8d64042016-03-08Verified
Montana State AGbd_c2de19aa1fb0f7b02016-03-08Candidate

Name: 1-800 Flowers
norm: 1 800 flowers

Name: 1-800 Flowers
norm: 1 800 flowers
Industry: Retail & Consumerllm

Discovered: Feb 15, 2016
Breach occurred: Feb 15, 2016 – Feb 17, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 8, 2016
Affected individuals: 37state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Office of the Attorney General of New Hampshire

During the incident: Initiated an investigation
Providing written notification to affected residents
Provided a dedicated call center for potentially affected individuals
Working closely with leading security experts
Changes made: Implement measures to further strengthen the security of its system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGMar 8 · first

Montana State AGMar 8 · first

New Hampshire State AGMar 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/1-800-flowers-20160308.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2016
Raw hash: 69e3257bebf69cd1c2fb9c47bf2b77079f164d5c11d33865d3e5feaf02bff33f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entity1-800 Flowers

Victim entity1-800 Flowers

Incidentdiscovered Feb 15, 2016

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov