HackingRetail & ConsumerRetailVulnerability ExploitTargetedIdentity (basic)Financial accountCredentialsLowContained

Sugarfina USA, LLC

bd_cbbc835a8a32a559 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 15, 2021

Filed

May 25, 2021

To disclose

19 weeks

Affected

50state residents only

Linked

9 filings

Confidence

65%

Full breach record for Sugarfina USA, LLC →

Sugarfina USA, LLC notified Montana regulators of a cyber-attack involving malicious code on its website that potentially exposed customer payment card information (names, billing addresses, card numbers, CVVs) and credentials. The unauthorized access window was November 1, 2019, to September 3, 2020. Sugarfina discovered the incident on January 15, 2021, secured the site, and launched an investigation.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 441 days

discovery → filing · 19 weeks / 130 days

Nov 1, 2019

Begins

Jan 15, 2021

Discovered

May 25, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_5ca080b9a6988def2021-05-25Verified
Massachusetts State AGbd_8fd4aa394c9b33e92021-05-25Verified
California State AGbd_9ef0158eb8fcad352021-05-25Verified
Oregon State AGbd_af6dc0ec43bde3f12021-05-25Verified

Show 4 more filings ↓up to 144d gap

Indiana State AGbd_b2b0346c19ea77922021-05-25Verified
Washington State AGbd_ce2b887a3ceb24d22021-05-25Verified
New Hampshire State AGbd_2dd44e96e01783982021-06-01 · +7dVerified
Illinois State AGbd_ea98cd3f8d09cd7d2021-01-01 · +144dCandidate

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com
Industry: Retail & Consumerllm

Discovered: Jan 15, 2021
Breach occurred: Nov 1, 2019 – Sep 3, 2020
Undetected for: 441 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 50state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: notifying state regulators
Initial access: exploit_public_facing

During the incident: Launched an investigation into the suspicious activity
Performed a review of its website code
Took steps to confirm the identity of the customers
Took immediate steps to secure its website
Notifying state regulators
Changes made: Continuing to review our existing policies and procedures
Implement additional safeguards to further secure payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+144d

Massachusetts State AG+144d

California State AG+144d

Oregon State AG+144d

Indiana State AG+144d

Washington State AG+144d

Montana State AG+144d · this page

New Hampshire State AG+151d

Pattern: first filing Jan 1 (IL), last Jun 1 (NH) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Sugafina-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2021
Raw hash: 031d2c9a114a76e9b176e101a3bcbdf03ac62121025f3088bdac1aeaafd63336

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySugarfina USA, LLC

Victim entitySugarfina USA, LLC

Incidentdiscovered Jan 15, 2021

Stated responseLaunched an investigation into the suspicious activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov