HackingRetail & ConsumerRetailBackdoor / C2Capture App DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Financial accountLowContained

Best Buy Co., Inc.

bd_abf1ad4c92fe5228 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 13, 2018

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

86%

Full breach record for Best Buy Co., Inc. →5 incidents on file

Best Buy Co., Inc. notified customers that a third-party vendor, [24]7.ai, suffered a cyber intrusion in which malicious code was inserted into its customer service chat software between September 26 and October 12, 2017. The code enabled unauthorized access to payment card information (name, address, card number, expiration date, security code) of BestBuy.com customers. Best Buy publicly disclosed on April 5, 2018 and sent consumer notifications April 12, 2018. Identity Guard credit monitoring offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 26, 2017

Begins

Apr 13, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Part of [24]7.ai supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3d9c5856ad205a4c2018-04-13Verified by operator
Massachusetts State AGbd_8fa5e4e8d23657b22018-04-13Verified
New Hampshire State AGbd_aed67aaeddf0751b2018-04-13Verified
Montana State AGbd_935b6af16c9aadf62018-04-12 · +1dCandidate

Show 1 more filing ↓up to 12d gap

Oregon State AGbd_3127e7742cdefbe02018-04-25 · +12dVerified

Name: Best Buy Co., Inc.
norm: best buy

Name: Best Buy Co., Inc.
norm: best buy
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 26, 2017 – Oct 12, 2017
Materiality determined: —
Notification sent: Apr 12, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Third party: via [24]7.ai
Initial access: supply_chain

During the incident: Quickly began working to identify the Best Buy customers who may be affected
Engaged leading data security experts to assist with the investigation and confirm that the malicious code had been removed from its software and the unauthorized access had been stopped
Made changes to how the [24]7.ai software operates on our site so the malicious code no longer poses a risk
Changes made: Arranged with Identity Guard® to provide identity theft services, including credit monitoring, at no cost to affected customers for one year
Changed how the [24]7.ai software operates on BestBuy.com to prevent recurrence
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGApr 12 · first

Washington State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d

California State AG+1d · this page

Oregon State AG+13d

Pattern: first filing Apr 12 (MT), last Apr 25 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-135278
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2018
Raw hash: 57102a16d773e340ef823c7833f2d390d8417af602e4882fbe388b4fe7a23c62

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBest Buy Co., Inc.

Victim entityBest Buy Co., Inc.

IncidentThird-Party / Supply Chain

Stated responseQuickly began working to identify the Best Buy customers who may be affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov