HackingSupply Chain (3P Vendor)Customer Data InvolvedPCIFINANCIAL_ACCOUNTLowContained
Vermont Christmas Company
bd_c56e39394fec7748 · schema v1 · pii pii-v1
Full breach record for Vermont Christmas Company →Vermont Christmas Company notified New Hampshire AG of a third-party vendor breach involving CommerceV3. Unauthorized access to CommerceV3 systems occurred between Nov 24, 2021 and Dec 14, 2022. Cardholder information was potentially impacted. VCC is reviewing vendor policies and notifying regulators. No specific count of affected individuals was disclosed in this filing.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_1627e564dd024a85Vermont State AGfiled 2023-08-09Verified
- bd_bbb64d7a974fdbe5California State AGfiled 2023-08-09Candidate
- bd_e2882215251a929bMaine State AGfiled 2023-08-09Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/vermont-christmas-20230809.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 9, 2023
- Raw hash
- 48d083a8e1ad3aa7848aefffb18b99384a0fbf1f79e0f5d929c45e8d273bac89
Reporting entity
- Name
- Vermont Christmas Companynorm: vermont christmas
- Domain
- vermontchristmasco.com
Victim entity
- Name
- Vermont Christmas Companynorm: vermont christmas
- Domain
- vermontchristmasco.com
Incident
- Discovered
- —
- Materiality determined
- Jun 8, 2023
- Notification sent
- Aug 9, 2023
- Affected individuals
- Not disclosed
- Data types
- PCIFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Providing written notice of the CommerceV3 event to relevant regulators
- Third party
- via CommerceV3
- Initial access
- supply_chain
Compliance
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.