MalwareRetail & ConsumerRetailRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

32 Bar Blues, LLC

bd_c3ef525552cb5ef6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2022

Filed

Oct 6, 2022

To disclose

31 weeks

Affected · nationwide

77,303534 in this filing

Linked

5 filings

Confidence

65%

Full breach record for 32 Bar Blues, LLC →4 incidents on file

32 Bar Blues LLC notified the New Hampshire Attorney General of a data security incident involving its third-party payment processor, Freestyle Solutions. Malware installed on Freestyle's systems between September 2020 and February 2022 captured payment card data. 32 Bar Blues identified 77,303 affected individuals nationwide, including 534 New Hampshire residents. The company notified its payment processor, engaged forensic support, and mailed notices to affected customers by October 6, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 529 days

discovery → filing · 31 weeks / 219 days

Sep 18, 2020

Begins

Mar 1, 2022

Discovered

Oct 6, 2022

Filed

vs. sector median

+22 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_6ba25512e76f272b2022-10-06Verified
California State AGbd_a0df373a479c131a2022-10-06Candidate
Washington State AGbd_d5f09118a64bbe722022-10-06Verified
Maine State AGbd_c2c64fd97c5ee3332022-10-05 · +1dCandidate

Name: 32 Bar Blues, LLC
norm: 32 bar blues
Domain: 32barblues.com

Name: 32 Bar Blues, LLC
norm: 32 bar blues
Domain: 32barblues.com
Industry: Retail & Consumerllm

Discovered: Mar 1, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 529 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2022
Affected individuals: 77,303state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralFreestyle notified the Cyber Fraud Task Force of the U.S. Secret Service’s Chicago Field Office
Third party: via Freestyle Solutions
Initial access: supply_chain

During the incident: Notified credit card payment processor / acquirer on March 3, 2022
Engaged external support to assist with record deduping and address look ups
Established a call center to answer notice recipient’s questions
Sent notice to 77,303 individuals in the U.S.
Changes made: Freestyle took steps to contain the incident, fortify its controls, and further enhance its payment card security
Freestyle engaged Verizon to conduct a PCI Forensic Investigation and advise on containment and remediation activities
Freestyle notified the Cyber Fraud Task Force of the U.S. Secret Service’s Chicago Field Office
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(219 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGOct 5 · first

Maine State AG+1d

California State AG+1d

Washington State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/32bar-blues-20221006.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2022
Raw hash: 680433d0255ff9f27cd38ba2f32f655adee9205ab110a0c470339fb549e45f6c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entity32 Bar Blues, LLC

Victim entity32 Bar Blues, LLC

Incidentdiscovered Mar 1, 2022

Stated responseNotified credit card payment processor / acquirer on March 3, 2022

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov