HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsMediumContained

32 Bar Blues, LLC

bd_d5f09118a64bbe72 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2022

Filed

Oct 6, 2022

To disclose

31 weeks

Affected · nationwide

77,3032,037 in this filing

Linked

5 filings

Confidence

66%

Full breach record for 32 Bar Blues, LLC →4 incidents on file

32 Bar Blues LLC notified Washington AG of a data breach involving its third-party payment vendor, Freestyle Solutions. Malware installed on Freestyle's systems between Sept 2020 and Feb 2022 captured customer payment card data. 77,303 U.S. individuals affected; 2,037 Washington residents. Notification sent Oct 6, 2022.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d31 weeks discovery → filing

Incident timeline

undetected · 529 days

discovery → filing · 31 weeks / 219 days

Sep 18, 2020

Begins

Mar 1, 2022

Discovered

Oct 6, 2022

Filed

vs. sector median

+24 wks slower

This filing is one of 5 about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_6ba25512e76f272b2022-10-06Verified
California State AGbd_a0df373a479c131a2022-10-06Candidate
New Hampshire State AGbd_c3ef525552cb5ef62022-10-06Verified
Maine State AGbd_c2c64fd97c5ee3332022-10-05 · +1dCandidate

Name: 32 Bar Blues, LLC
norm: 32 bar blues
Domain: 32barblues.com

Name: 32 Bar Blues, LLC
norm: 32 bar blues
Domain: 32barblues.com
Industry: Retail & Consumerllm

Discovered: Mar 1, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 529 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2022
Affected individuals: 77,303state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney GeneralFreestyle notified the Cyber Fraud Task Force of the U.S. Secret Service’s Chicago Field Office
Third party: via Freestyle Solutions
Initial access: external_remote_services

During the incident: Notified credit card payment processor / acquirer
Engaged external support to assist with record deduping and address look ups
Established a call center to answer notice recipient’s questions
Sent notice to affected individuals
Changes made: Freestyle took steps to contain the incident, fortify its controls, and further enhance its payment card security
Freestyle engaged Verizon to conduct a PCI Forensic Investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(219 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGOct 5 · first

Maine State AG+1d

California State AG+1d

New Hampshire State AG+1d

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15553.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2022
Raw hash: a6f746756e22df30726a0c58af5754399d17d4ee04b69499e96db9e03e6b1c8c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entity32 Bar Blues, LLC

Victim entity32 Bar Blues, LLC

Incidentdiscovered Mar 1, 2022

Stated responseNotified credit card payment processor / acquirer

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com