HackingRetail & ConsumerRetailSkimmerCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Special Buys Clothing Inc.

bd_d39d671c575ae478 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2022

Filed

Dec 9, 2022

To disclose

10 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for Special Buys Clothing Inc. →

Special Buys Clothing Inc. (DBA Bargain Balloons) experienced a data breach from September 27 to November 7, 2022, involving a malicious skimmer on its website checkout page. Customer names, addresses, emails, phone numbers, and credit card information were compromised. The incident was discovered in October 2022 after a customer reported fraud. The company engaged forensic experts, removed the code, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 1, 2022 → Notified Dec 15, 202275d ✗ CA 60-day late10 weeks discovery → filing

Incident timeline

undetected · 4 days

discovery → filing · 10 weeks / 69 days

Sep 27, 2022

Begins

Oct 1, 2022

Discovered

Dec 9, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_196e44d4a451a3462022-12-09Verified
Maine State AGbd_92d668249e35cf792022-12-09Candidate
Indiana State AGbd_37c987a590a024302022-12-12 · +3dVerified
New Hampshire State AGbd_d002a3fd6a6956212022-12-12 · +3dCandidate

Show 4 more filings ↓up to 52d gap

Montana State AGbd_7f2e9177a73a85352022-12-13 · +4dVerified
California State AGbd_e92b5897889400622023-01-19 · +41dVerified
Maine State AGbd_47ae83101c7c238c2023-01-20 · +42dVerified
New Hampshire State AGbd_b7879b167a37cbd02023-01-30 · +52dVerified

Name: Special Buys Clothing Inc.
norm: special buys clothing
Domain: bargainballoons.com

Name: Special Buys Clothing Inc.
norm: special buys clothing
Domain: bargainballoons.com
Also named: Special Buys Clothing Inc.dba oflegal entity
Bargain Balloonsdba oftrade name
Industry: Retail & Consumerllm

Discovered: Oct 1, 2022
Breach occurred: Sep 27, 2022 – Nov 7, 2022
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 15, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified applicable privacy commissioners
Initial access: exploit_public_facing

During the incident: Hired a leading firm of forensic IT experts
Secured the website
Removed the malicious code
Performed a thorough scan of our online systems
Notified applicable privacy commissioners, payment gateways and local police
Offering identity and credit monitoring services for twelve months
Changes made: Implemented additional measures and enhanced security tools to further protect information on our website and our IT systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: CA 60-day late · 75d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 1, 2022
→ Notified: Dec 15, 2022
75d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 1, 2022 → Notified: Dec 15, 2022	75d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Massachusetts State AGDec 9 · first

Maine State AGDec 9 · first

California State AGDec 9 · first · this page

Indiana State AG+3d

New Hampshire State AG+3d

Montana State AG+4d

California State AG+41d

Maine State AG+42d

New Hampshire State AG+52d

Pattern: first filing Dec 9 (MA), last Jan 30 (NH) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-559898
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2022
Raw hash: 1ca118f1bc3cf60f086fa717fef453c2a0c1d64ca605ad715ea468928db199ec

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySpecial Buys Clothing Inc.

Victim entitySpecial Buys Clothing Inc.

Incidentdiscovered Oct 1, 2022

Stated responseHired a leading firm of forensic IT experts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov