HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)LowContained

Barbecue Renew

bd_d5f550d53b50ae43 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2014

Filed

Jan 16, 2015

To disclose

15 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Barbecue Renew →

Barbecue Renew Inc., an e-commerce retailer of grill accessories, experienced a series of cyber attacks on its web server (www.grillparts.com) between January 19, 2014, and October 2014. Attackers exploited a vulnerability in the web server, exposing cardholder data including names, addresses, payment card numbers, expiration dates, and security codes. The company discovered the incident in October 2014 after receiving notifications from its acquiring bank and payment card brands regarding fraudulent activity. Barbecue Renew engaged forensic investigators, notified law enforcement, and remediated the vulnerability. Affected customers were offered one year of identity theft protection services through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 255 days

discovery → filing · 15 weeks / 107 days

Jan 19, 2014

Begins

Oct 1, 2014

Discovered

Jan 16, 2015

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_42d4910a2813154b2015-01-16Verified
Massachusetts State AGbd_4dde69af1ac4170e2015-01-20 · +4dVerified

Name: Barbecue Renew
norm: barbecue renew
Domain: grillparts.com

Name: Barbecue Renew
norm: barbecue renew
Domain: grillparts.com
Industry: Retail & Consumerllm

Discovered: Oct 1, 2014
Breach occurred: Jan 19, 2014 – Oct 1, 2014
Undetected for: 255 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Contacted state law enforcementProvided a final investigative report to the card brands and Bank of America
Initial access: exploit_public_facing

During the incident: Began an internal investigation
Took corrective measures to remediate any possible vulnerability
Removed or fixed vulnerable web pages
Notified law enforcement
Retained a third party forensic investigator
Engaged leading IT security firms
Engaged data privacy and protection attorneys
Worked with payment industry contacts
Changes made: Remedied the vulnerability that was suspected of having been exploited by attackers
Devoting all necessary resources to ongoing efforts to enhance information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(107 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJan 16 · first

California State AGJan 16 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-48107
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 16, 2015
Raw hash: b4720f219ef4ae791d2590956ce59fcb232b9911073902de900aeadda539cfde

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBarbecue Renew

Victim entityBarbecue Renew

Incidentdiscovered Oct 1, 2014

Stated responseBegan an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov