HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Peaceful Valley Farm Supply, Inc.

bd_d41474a6366319bc · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 11, 2018

To disclose

—

Affected

1,224state residents only

Linked

5 filings

Confidence

67%

Full breach record for Peaceful Valley Farm Supply, Inc. →

Peaceful Valley Farm Supply, Inc. notified the Washington Attorney General of a data breach affecting 1,224 state residents. Unauthorized access occurred between February 9, 2018, and August 22, 2018, via malicious software on the company website. Exposed data included names, addresses, payment card numbers, and email addresses. The malware was removed on August 22, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 9, 2018

Begins

Sep 11, 2018

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_6ed5bbd16af3fbcf2018-09-11Verified
New Hampshire State AGbd_bca7455d936f370d2018-09-11Verified
Oregon State AGbd_2d29e2dafba284cf2018-09-12 · +1dCandidate
Massachusetts State AGbd_15b58d3d197a63202018-09-19 · +8dVerified

Name: Peaceful Valley Farm Supply, Inc.
norm: peaceful valley farm supply

Name: Peaceful Valley Farm Supply, Inc.
norm: peaceful valley farm supply
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Feb 9, 2018 – Aug 22, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 1,224state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: The malicious software has been removed as of 8/22/18 from our website
Implemented security measures to ensure the confidentiality of the personal information of those we serve
Conducting a thorough review of this security incident and the potentially affected records
Implemented additional security measures designed to prevent a recurrence of such an attack
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Implemented security measures to ensure the confidentiality of the personal information of those we serve
Implemented additional security measures designed to prevent a recurrence of such an attack
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGSep 11 · first

New Hampshire State AGSep 11 · first

Washington State AGSep 11 · first · this page

Oregon State AG+1d

Massachusetts State AG+8d

Pattern: first filing Sep 11 (CA), last Sep 19 (MA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10649.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2018
Raw hash: a4680470d8b50350167ab4e6cbc85697d18fae6a528efc66dc72e08d51e948f1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPeaceful Valley Farm Supply, Inc.

Victim entityPeaceful Valley Farm Supply, Inc.

IncidentMisconfiguration

Stated responseThe malicious software has been removed as of 8/22/18 from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com