HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Paper and Ink Arts LLC
bd_af89ae14ab759836 · schema v1 · pii pii-v1
Full breach record for Paper and Ink Arts LLC →Paper and Ink Arts, LLC dba John Neal Books notified consumers of a data breach affecting its third-party e-commerce provider, CommerceV3. The breach occurred between November 24, 2021, and December 14, 2022, compromising customer names, addresses, and payment card details. John Neal Books migrated its platform to Big Commerce in February 2023.
Vermont clock✗ VT AG >45 bday22 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-07-05-paper-and-ink-arts-llc-dba-john-neal-books-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 5, 2023
- Raw hash
- 56fa7f132205a6d5adf9e7163270d910955673fe75cec543041f022ed48c6fed
Reporting entity
- Name
- Paper and Ink Arts LLCnorm: paper and ink arts
Victim entity
- Name
- Paper and Ink Arts LLCnorm: paper and ink arts
Incident
- Discovered
- Feb 1, 2023
- Materiality determined
- —
- Notification sent
- Jul 5, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notice with the Office of the Vermont Attorney General
- Third party
- via CommerceV3
- Initial access
- supply_chain
Compliance
- Time to disclose
- 22 weeks(154 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.