HackingNAICS WhSupply Chain (3P Vendor)Customer Data InvolvedFINANCIAL_ACCOUNTIDENTITY_BASICLowContained
W.W. GRAINGER, INC.
bd_a12fd61c534fd6ab · schema v1 · pii pii-v1
Full breach record for W.W. GRAINGER, INC. →W.W. Grainger, Inc. reported a third-party data breach involving its online chat service provider, [24]7.ai. The incident occurred between September 26, 2017, and October 12, 2017, potentially exposing credit card numbers, security codes, expiration dates, names, and addresses of customers who used guest checkout. Grainger engaged forensic experts, notified law enforcement and credit card companies, and offered one year of identity monitoring via Kroll.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_6cb01f45a52b5004Oregon State AGfiled 2018-04-20Verified by operator
- bd_e6ca845903bcf77cMontana State AGfiled 2018-04-17(3d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-135471
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 20, 2018
- Raw hash
- 64f7c875e3b3c623770a9571f8dd5caa0d17a21f48b363845bf8c25ff1a44fde
Reporting entity
- Name
- W.W. GRAINGER, INC.norm: ww grainger
- Domain
- grainger.com
Victim entity
- Name
- W.W. GRAINGER, INC.norm: ww grainger
- Domain
- grainger.com
Incident
- Discovered
- Oct 12, 2017
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Regulator citations
- notifying law enforcement officials
- Third party
- via [24]7.ai
- Initial access
- supply_chain
Compliance
- Time to disclose
- 27 weeks(190 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.