HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsCredentialsLowResolved

PupBox

bd_d9e74f7ccefc139c · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 2, 2020

Filed

Oct 2, 2020

To disclose

4 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for PupBox →

PupBox (a business unit of Petco Animal Supplies Stores, Inc.) disclosed a security incident affecting its website. An unauthorized plugin captured personal information, including names, emails, addresses, credit card numbers, expiration dates, CVVs, and passwords, between February 11, 2020, and August 9, 2020. The company became aware of the incident on September 2, 2020, after receiving notifications of fraudulent credit card activities. The incident has been resolved, and the company is implementing additional cybersecurity protections.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 2, 2020 → Notified Oct 2, 202030d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

undetected · 204 days

discovery → filing · 4 weeks / 30 days

Feb 11, 2020

Begins

Sep 2, 2020

Discovered

Oct 2, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_0cff5122d7572df92020-10-02Verified
Oregon State AGbd_112e1659397ddbcd2020-10-02Candidate
New Hampshire State AGbd_1a005f6b179da35d2020-10-02Verified
Indiana State AGbd_48adbf2bc53591ee2020-10-02Verified

Show 3 more filings ↓

Montana State AGbd_94b2f1b7ca0d521f2020-10-02Verified by operator
Washington State AGbd_a35955daeb84c7992020-10-02Verified
Maine State AGbd_ac9a1da511d3b2862020-10-02Verified

Name: PupBox
norm: pupbox
Domain: pupbox.com

Name: PupBox
norm: pupbox
Domain: pupbox.com
Industry: Retail & Consumerllm

Discovered: Sep 2, 2020
Breach occurred: Feb 11, 2020 – Aug 9, 2020
Undetected for: 204 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of a leading cybersecurity firm
Resolved this incident
Established a toll-free number you may call if you have any questions
Changes made: Taking steps to prevent an attack in the future
Making additional improvements that strengthen PupBox’s cybersecurity protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 2, 2020
→ Notified: Oct 2, 2020
30d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 2, 2020 → Notified: Oct 2, 2020	30d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Massachusetts State AGOct 2 · first

Oregon State AGOct 2 · first

New Hampshire State AGOct 2 · first

Indiana State AGOct 2 · first

Montana State AGOct 2 · first

Washington State AGOct 2 · first

Maine State AGOct 2 · first

California State AGOct 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194725
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2020
Raw hash: 6631ea4ba743b706853b49a9df377177e3f2d196032d64b4db6f82897a82476b

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityPupBox

Victim entityPupBox

Incidentdiscovered Sep 2, 2020

Stated responseLaunched an investigation with the assistance of a leading cybersecurity firm

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov