HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowResolved
John and Kira's Chocolates
bd_a8ee0c29e7059cf1 · schema v1 · pii pii-v1
Full breach record for John and Kira's Chocolates →John & Kira's Chocolates notified customers that their third-party e-commerce provider, CommerceV3, suffered an unauthorized access incident. An unauthorized party accessed CommerceV3 systems between November 24, 2021, and July 1, 2022, potentially obtaining customer order information including names, email addresses, billing addresses, payment card numbers, CVV codes, and expiration dates. John & Kira's was notified on June 12, 2023, and sent notices on June 15, 2023. The threat has been eliminated.
California clockDiscovered Jun 12, 2023 → Notified Jun 15, 20233d ✓ CA 60-day OK3 days discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_86918de2d1139fb7New Hampshire State AGfiled 2023-06-15Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-568098
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 15, 2023
- Raw hash
- 80734f01e53bd9858136adc8ef1444b224c010c344048c3c17b61981e6d0383c
Reporting entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Victim entity
- Name
- John and Kira's Chocolatesnorm: john and kira s chocolates
- Domain
- johnandkiras.com
Incident
- Discovered
- Jun 12, 2023
- Materiality determined
- —
- Notification sent
- Jun 15, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Third party
- via CommerceV3
- Initial access
- supply_chain
Compliance
- Time to disclose
- 3 days(3 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 3d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 12, 2023→ Notified: Jun 15, 20233d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.