DisclosureLens
HackingRetailSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumResolved

Roots & Harvest Direct LLC

bd_cbec415dc44f19ab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2023

Filed

Jul 14, 2023

To disclose

5 weeks

Affected · nationwide

4,07326 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Roots & Harvest Direct LLC →

Roots & Harvest Direct LLC reported a data breach affecting 26 Maine residents after a cybersecurity incident at its third-party e-commerce vendor, CommerceV3. The incident occurred between November 24, 2021, and December 14, 2022, and was discovered on June 6, 2023. The compromised data includes names and financial account or credit/debit card numbers, along with security codes, access codes, or passwords.

Maine clockDiscovered Jun 6, 2023 → Filed with AG Jul 14, 202338d ⏱ ME AG >30d5 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 559 days
discovery → filing · 5 weeks / 38 days

Nov 24, 2021

Begins

Jun 6, 2023

Discovered

Jul 14, 2023

Filed

This filing is one of 5 about the same incident.View merged incident
Part of CommerceV3 supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Indiana State AGJul 6 · first
Massachusetts State AG+7d
New Hampshire State AG+7d
Montana State AG+7d
Maine State AG+8d · this page

Pattern: first filing Jul 6 (IN), last Jul 14 (ME) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.