HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedAuthenticationCredentialsFinancial accountIdentity (basic)MediumContained

Sugarfina USA, LLC

bd_ce2b887a3ceb24d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2021

Filed

May 25, 2021

To disclose

19 weeks

Affected

1,019state residents only

Linked

9 filings

Confidence

71%

Full breach record for Sugarfina USA, LLC →

Sugarfina USA, LLC notified Washington AG of a cyberattack affecting 1,019 residents. Unauthorized actors may have accessed payment card info (name, address, card number, CVV, username/password) from orders placed Nov 2019–Sep 2020. Incident discovered Jan 2021; notification sent May 2021.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 441 days

discovery → filing · 19 weeks / 130 days

Nov 1, 2019

Begins

Jan 15, 2021

Discovered

May 25, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_5ca080b9a6988def2021-05-25Verified
Massachusetts State AGbd_8fd4aa394c9b33e92021-05-25Verified
California State AGbd_9ef0158eb8fcad352021-05-25Verified
Oregon State AGbd_af6dc0ec43bde3f12021-05-25Verified

Show 4 more filings ↓up to 144d gap

Indiana State AGbd_b2b0346c19ea77922021-05-25Verified
Montana State AGbd_cbbc835a8a32a5592021-05-25Verified
New Hampshire State AGbd_2dd44e96e01783982021-06-01 · +7dVerified
Illinois State AGbd_ea98cd3f8d09cd7d2021-01-01 · +144dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Sugarfina USA, LLC
norm: sugarfina usa
Domain: sugarfina.com
Industry: Retail & Consumerllm

Discovered: Jan 15, 2021
Breach occurred: Nov 1, 2019 – Sep 3, 2020
Undetected for: 441 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2021
Affected individuals: 1,019state-resident count only
Data types: AuthenticationCredentialsFinancial accountIdentity (basic)
Data elements: NameFinancial account numberUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 400-499dexposure 300-399d
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General (Washington)
Initial access: exploit_public_facing

During the incident: Launched an investigation to determine the nature and scope of this incident
Took steps to address the issue and to secure its website
Performed a comprehensive review of information stored on the impacted systems
Manual review of its records to determine the identities and contact information for potentially impacted individuals
Notifying relevant regulatory authorities of this event
Changes made: Reviewing its existing policies and procedures
Implementing additional safeguards to further secure the payment information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+144d

Massachusetts State AG+144d

California State AG+144d

Oregon State AG+144d

Indiana State AG+144d

Montana State AG+144d

Washington State AG+144d · this page

New Hampshire State AG+151d

Pattern: first filing Jan 1 (IL), last Jun 1 (NH) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10470.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2021
Raw hash: cd23da99ebf9180a590240cae72719713ec805913230cd03cb23de90debd2204

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entitySugarfina USA, LLC

Incidentdiscovered Jan 15, 2021

Stated responseLaunched an investigation to determine the nature and scope of this incident

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com