HackingRetail & ConsumerRetailSkimmerCapture Stored DataCustomer Data InvolvedData ExfiltratedFinancial accountIdentity (basic)LowContained

Chefs' Toys, LLC

bd_bb3b34fb201a45e9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 29, 2022

Filed

Jul 8, 2022

To disclose

14 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

63%

Full breach record for Chefs' Toys, LLC →

Chefs' Toys, LLC disclosed a data breach involving hidden malicious code (skimmer) on its website that captured payment card information. The unauthorized access occurred between November 12, 2021, and April 26, 2022. The company discovered the incident on March 29, 2022, after receiving reports of unauthorized payment card activity. Affected data includes names and credit/debit card numbers. The company engaged forensic investigators, updated passwords, and implemented additional security safeguards.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 29, 2022 → Notified Jun 24, 202287d ✗ CA 60-day late14 weeks discovery → filing

Incident timeline

undetected · 137 days

discovery → filing · 14 weeks / 101 days

Nov 12, 2021

Begins

Mar 29, 2022

Discovered

Jul 8, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_75e3dba5a020a67e2022-07-08Verified
Maine State AGbd_418e1bb4d6a76c472022-07-05 · +3dCandidate
Montana State AGbd_e3f9328ea5c46db92022-07-05 · +3dVerified
Indiana State AGbd_64708e127592f1e82022-06-30 · +8dVerified

Name: Chefs' Toys, LLC
norm: chefs toys
Domain: chefstoys.com

Name: Chefs' Toys, LLC
norm: chefs toys
Domain: chefstoys.com
Industry: Retail & Consumerllm

Discovered: Mar 29, 2022
Breach occurred: Nov 12, 2021 – Apr 26, 2022
Undetected for: 137 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 24, 2022
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Began an investigation and review of our website
Engaged an outside cyber security company for forensic analysis
Updated user passwords
Implemented additional security safeguards and controls on our website
Changes made: Updated user passwords
Implemented additional security safeguards and controls on our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: CA 60-day late · 87d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 29, 2022
→ Notified: Jun 24, 2022
87d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 29, 2022 → Notified: Jun 24, 2022	87d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 30 · first

Maine State AG+5d

Montana State AG+5d

Massachusetts State AG+8d

California State AG+8d · this page

Pattern: first filing Jun 30 (IN), last Jul 8 (CA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-555089
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2022
Raw hash: 67eb4464f9c4ff14995ebda6f037e2b50351e08231f46995acb5f815cb3e2cde

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityChefs' Toys, LLC

Victim entityChefs' Toys, LLC

Incidentdiscovered Mar 29, 2022

Stated responseBegan an investigation and review of our website

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov