HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountIdentity (basic)PIIMediumContained

Heirloom Roses

bd_c9b21be8111f06ec · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 12, 2021

Filed

Dec 17, 2021

To disclose

18 weeks

Affected

3,118state residents only

Linked

9 filings

Confidence

71%

Full breach record for Heirloom Roses →

Heirloom Roses, a retail business, notified the Washington AG of a cyberattack where malicious code on its website captured customer names and credit card data. The incident occurred between Feb 12 and Oct 26, 2021, and was discovered on Aug 12, 2021. 3,118 Washington residents were affected. Heirloom engaged forensic specialists, removed the code, changed payment processors, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d18 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 181 days

discovery → filing · 18 weeks / 127 days

Feb 12, 2021

Begins

Aug 12, 2021

Discovered

Dec 17, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_3c6bde4e9111e4832021-12-17Verified
Oregon State AGbd_6534d6c864b8f2ca2021-12-17Verified
California State AGbd_660ee01c3e82267e2021-12-17Verified
Montana State AGbd_967abeb7c36a4e582021-12-17Verified

Show 4 more filings ↓up to 350d gap

Massachusetts State AGbd_ddc8131d0fee95fd2021-12-17Verified
Indiana State AGbd_f6f92f81ea61beb52021-12-17Verified
New Hampshire State AGbd_51464c0d5acb01872021-12-23 · +6dVerified
Illinois State AGbd_98e2cfac9ef7eece2021-01-01 · +350dCandidate

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Heirloom Roses
norm: heirloom roses
Industry: Retail & Consumerllm

Discovered: Aug 12, 2021
Breach occurred: Feb 12, 2021 – Oct 26, 2021
Undetected for: 181 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 17, 2021
Affected individuals: 3,118state-resident count only
Data types: PIIFinancial account
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 200-299d
WA-stated discovery: Found while ongoing
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Provided written notice of this incident to the Washington residents pursuant to Washington law
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists to assist with a thorough investigation
Took steps to secure its website
Removed the malicious code
Implemented additional security measures
Transitioned to a new payment processor
Offered complimentary credit monitoring and identity protection services offered through Kroll for 12 months
Changes made: Removed the malicious code
Implemented additional security measures
Transitioned to a new payment processor to prevent a similar incident from occurring in the future
Continues to review its policies and procedures related to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+350d

Oregon State AG+350d

California State AG+350d

Montana State AG+350d

Massachusetts State AG+350d

Indiana State AG+350d

Washington State AG+350d · this page

New Hampshire State AG+356d

Pattern: first filing Jan 1 (IL), last Dec 23 (NH) — a 356-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11299.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2021
Raw hash: 1acc8ed15278dedf074a27abe0d406d22e2d33e10f326b8389e0b57f1f42a546

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityHeirloom Roses

Incidentdiscovered Aug 12, 2021

Stated responseEngaged third-party forensic specialists to assist with a thorough investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com