HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Canyon Bakehouse

bd_aca4b7147d4d1d20 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 8, 2019

Filed

Apr 9, 2019

To disclose

≤1 day

Affected

47state residents only

Linked

4 filings

Confidence

64%

Full breach record for Canyon Bakehouse →

Canyon Bakehouse, LLC notified NH AG of a data breach affecting 47 NH residents. Unauthorized access to the website's checkout system (Feb 12-19, 2019 and Mar 29, 2017-Jan 9, 2019) exposed names, payment card numbers, expiration dates, and CVVs. Canyon disabled site functions, engaged experts, notified law enforcement and card companies, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 740 days

discovery → filing · ≤1 day / 1 days

Mar 29, 2017

Begins

Apr 8, 2019

Discovered

Apr 9, 2019

Filed

vs. sector median

7 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_4cda2b20fcb54ca92019-04-09Candidate
Montana State AGbd_ba637a74a06b8b2f2019-04-09Verified
Massachusetts State AGbd_81e32aaa1c1f26b82019-04-11 · +2dVerified

Name: JONES DAY
norm: jones day
Domain: jonesday.com

Name: Canyon Bakehouse
norm: canyon bakehouse
Industry: Retail & Consumerllm

Discovered: Apr 8, 2019
Breach occurred: Mar 29, 2017 – Feb 19, 2019
Undetected for: 740 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2019
Affected individuals: 47state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Contacted law enforcement
Notified the payment card companies
Temporarily disabled the ordering and account login functions on the website
Taking steps to further enhance the security of the website, including replacing the platform supporting the site
Offering credit-monitoring and identity-protection services through Experian at no charge for a period of one year
Changes made: Replacing the platform supporting the website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGApr 9 · first

Montana State AGApr 9 · first

New Hampshire State AGApr 9 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jones-day-20190409.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2019
Raw hash: e5130d5ec15687e9636be8cb00c21afa2f3de61f4607dd69ecb7187f52e3a055

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityJONES DAY

Victim entityCanyon Bakehouse

Incidentdiscovered Apr 8, 2019

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov