HackingRetail & ConsumerRetailSQL InjectionTargetedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

GRAETER'S ICE CREAM COMPANY

bd_b0df226d0c1ce28e · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 28, 2019

Filed

Jul 23, 2019

To disclose

25 days

Affected

12state residents only

Linked

3 filings

Confidence

65%

Full breach record for GRAETER'S ICE CREAM COMPANY →2 incidents on file

Graeter’s Ice Cream notified customers of a payment card data breach affecting its e-commerce site. Malicious code was present from Dec 30, 2018 to June 13, 2019, copying checkout data including names, addresses, and full payment card details. A cybersecurity firm was engaged, and the company is migrating to a new platform with iframe technology.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 180 days

discovery → filing · 25 days

Dec 30, 2018

Begins

Jun 28, 2019

Discovered

Jul 23, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_bd63842b2fd0aaf02019-07-23Verified
New Hampshire State AGbd_5caf9252ce406c7f2019-07-24 · +1dVerified

Name: GRAETER'S ICE CREAM COMPANY
norm: graeter s ice cream
Domain: graeters.com

Name: GRAETER'S ICE CREAM COMPANY
norm: graeter s ice cream
Domain: graeters.com
Industry: Retail & Consumerllm

Discovered: Jun 28, 2019
Breach occurred: Dec 30, 2018 – Jun 13, 2019
Undetected for: 180 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 19, 2019
Affected individuals: 12state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a leading cybersecurity firm to determine what had happened and what information may have been involved
Implemented a number of additional security measures, including using an expanded set of six different security scans on our environment
Moving to a new e-commerce platform that will use iframe technology so that payment card data will not be entered on our servers
Changes made: Moving to a new e-commerce platform that will use iframe technology so that payment card data will not be entered on our servers
Implementing an expanded set of six different security scans on our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 23 · first

Montana State AGJul 23 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-47.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 23, 2019
Raw hash: a20ab74ae46dc774af2dda64a5badeb940101c4da15d4feb66bb2743c3e825ac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGRAETER'S ICE CREAM COMPANY

Victim entityGRAETER'S ICE CREAM COMPANY

Incidentdiscovered Jun 28, 2019

Stated responseEngaged a leading cybersecurity firm to determine what had happened and what information may have been involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov