HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Best Buy Co., Inc.

bd_aed67aaeddf0751b · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2018

Filed

Apr 13, 2018

To disclose

6 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Best Buy Co., Inc. →5 incidents on file

Best Buy Co., Inc. notified the NH AG of a data breach involving third-party vendor [24]7.ai. Malicious code inserted between Sept 26 and Oct 12, 2017, allowed unauthorized access to customer payment card info (names, addresses, card numbers, CVV) for shoppers on BestBuy.com during that window. Best Buy engaged forensic experts, removed the code, and changed software operations. No count of affected individuals was provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 156 days

discovery → filing · 6 weeks / 43 days

Sep 26, 2017

Begins

Mar 1, 2018

Discovered

Apr 13, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Part of [24]7.ai supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3d9c5856ad205a4c2018-04-13Verified by operator
Massachusetts State AGbd_8fa5e4e8d23657b22018-04-13Verified
California State AGbd_abf1ad4c92fe52282018-04-13Verified
Montana State AGbd_935b6af16c9aadf62018-04-12 · +1dCandidate

Show 1 more filing ↓up to 12d gap

Oregon State AGbd_3127e7742cdefbe02018-04-25 · +12dVerified

Name: Best Buy Co., Inc.
norm: best buy

Name: Best Buy Co., Inc.
norm: best buy
Industry: Retail & Consumerllm

Discovered: Mar 1, 2018
Breach occurred: Sep 26, 2017 – Oct 12, 2017
Undetected for: 156 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 12, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Coordinating with law enforcement authorities
Initial access: supply_chain

During the incident: Engaged leading data security experts to assist with the investigation
Confirmed that the malicious code had been removed from its software
Stopped the unauthorized access
Made changes to how the [24]7.ai software operates on its website
Publicly announced the incident on April 5, 2018
Coordinating with law enforcement authorities
Arranged to provide identity theft services, including credit monitoring, at no cost for one year
Changes made: Changes to how the [24]7.ai software operates on its website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGApr 12 · first

Washington State AG+1d

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+1d · this page

Oregon State AG+13d

Pattern: first filing Apr 12 (MT), last Apr 25 (OR) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/best-buy-20180413.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2018
Raw hash: 268b1575c15616e986611744fc0f134cda2a5167b930b6d084bc1ba6c46c889f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBest Buy Co., Inc.

Victim entityBest Buy Co., Inc.

Incidentdiscovered Mar 1, 2018

Stated responseEngaged leading data security experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov