HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

STC Holdings LLC

bd_e11fc2bc71477d0e · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2024

Filed

Nov 27, 2024

To disclose

19 days

Affected

18state residents only

Linked

6 filings

Confidence

65%

STC Holdings LLC (operating TobaccoPipes.com) notified customers of a data security incident involving the third-party BigCommerce application 'FreshClick.' A malicious actor skimmed credit card and personal information from shoppers between Oct 15 and Nov 7, 2024. The company uninstalled the app, secured systems, and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 19 days

Oct 15, 2024

Begins

Nov 8, 2024

Discovered

Nov 27, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_f6e6a68a365e70d42024-11-27Verified
Massachusetts State AGbd_11707656521ddf0f2024-11-28 · +1dVerified
Maine State AGbd_f0cbd526669bc7082024-11-28 · +1dVerified
Vermont State AGbd_5f342a4f10d596f12024-12-02 · +5dVerified

Show 1 more filing ↓up to 12d gap

New Hampshire State AGbd_ff0dcc59156008642024-12-09 · +12dVerified

Name: STC Holdings LLC
norm: stc holdings

Name: STC Holdings LLC
norm: stc holdings
Domain: tobaccopipes.com
Also named: STC Holdings LLCoperating subsidiary ofholding company
Industry: Retail & Consumerllm

Discovered: Nov 8, 2024
Breach occurred: Oct 15, 2024 – Nov 7, 2024
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 18state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notifying relevant government agencies in accordance with applicable data privacy laws
Third party: via BigCommerce / FreshClick
Initial access: supply_chain

During the incident: Immediately uninstalled the compromised third-party application from our ecommerce website
Secured our systems to prevent further unauthorized access
Engaging security experts to conduct an independent forensics investigation
Notifying relevant government agencies in accordance with applicable data privacy laws
Notifying individuals, like yourself, whose information may have been compromised
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGNov 27 · first

Montana State AGNov 27 · first · this page

Massachusetts State AG+1d

Maine State AG+1d

Vermont State AG+5d

New Hampshire State AG+12d

Pattern: first filing Nov 27 (IN), last Dec 9 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/02/Consumer-notification-letter-26.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2024
Raw hash: 6e24c8be074354523f27b247a495ec5c61e38d23141ad12f7b2230eae077884b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTC Holdings LLC

Victim entitySTC Holdings LLC

Incidentdiscovered Nov 8, 2024

Stated responseImmediately uninstalled the compromised third-party application from our ecommerce website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov