HackingRetail & ConsumerRetailEmployee Data InvolvedGovernment IDEmploymentMediumContained

DELICATO VINEYARDS

bd_daee68abd97f8e3f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2018

Filed

Aug 14, 2018

To disclose

11 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for DELICATO VINEYARDS →3 incidents on file

Delicato Family Vineyards disclosed that an external individual accessed the VINES internal employee information system between April 26-27, 2018. The incident was discovered in June 2018. Social security numbers of current and former employees were potentially involved. The company changed credentials, implemented two-factor authentication, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 11 weeks / 74 days

Apr 26, 2018

Begins

Jun 1, 2018

Discovered

Aug 14, 2018

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_223c8df106626ddf2018-08-14Verified
New Hampshire State AGbd_c896f83971d06bbd2018-08-17 · +3dVerified

Name: DELICATO VINEYARDS
norm: delicato vineyards
Domain: delicato.com

Name: DELICATO VINEYARDS
norm: delicato vineyards
Domain: delicato.com
Industry: Retail & Consumerllm

Discovered: Jun 1, 2018
Breach occurred: Apr 26, 2018 – Apr 27, 2018
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2018
Affected individuals: Not disclosed
Data types: Government IDEmployment
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Changed the VINES credentials so that outside parties can no longer access the information
Conducted a thorough review of the potentially affected records
Offered 24 months of identity theft repair, fraud alerts, and credit monitoring through AllClear ID at no cost
Changes made: Implemented additional measures to monitor suspicious activity
Increased alerts for events including account lockouts, impossible (concurrent) logins and access from unfamiliar networks
Implemented a two-factor authentication process for certain users and access situations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 14 · first

California State AGAug 14 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-138841
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2018
Raw hash: 5b73c7ce34a11ca9f6b7c97c6dcbc713cf9ed45b0a7fd376cc70f34ce13a34af

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDELICATO VINEYARDS

Victim entityDELICATO VINEYARDS

Incidentdiscovered Jun 1, 2018

Stated responseChanged the VINES credentials so that outside parties can no longer access the information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov